Function at 0x43861b
Capabilities:
Create process on windows
Query environment variable
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xca0
mov eax, dword [0x4a02f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc50], eax
mov al, byte [ebp + 0xc]
push ebx
mov byte [ebp - 0xc54], al
mov eax, dword [ebp + 0x14]
push esi
push dword [ebp - 0xc54]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0xc5c], eax
lea eax, [ebp - 0xb9c]
xor ebx, ebx
push eax
mov dword [ebp - 0xc48], ebx
call fcn.004403d6
pop ecx
pop ecx
cmp dword [ebp - 0xb8c], ebx
jne 0x4386de
call fcn.0040ab90
xor esi, esi
inc esi
cmp eax, 2
jg 0x4386ac
push 2
push 0x29b
push str.installer_tdsetupuninstall.cc
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0xc48], esi
call fcn.0040add0
add eax, 8
push str.Could_not_get_installation_destination_path.
push eax
call fcn.00403540
pop ecx
pop ecx
test byte [ebp - 0xc48], 1
je 0x4386c0
lea ecx, [ebp - 0xb4]
call fcn.0040ae20
push ebx
push 1
lea ecx, [ebp - 0xb9c]
call fcn.00402b70
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046e0cd
leave
ret
push edi
call fcn.0040ab90
mov edi, str.installer_tdsetupuninstall.cc
test eax, eax
jg 0x438737
push ebx
push 0x29f
push edi
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0xc48], 2
call fcn.0040add0
add eax, 8
push str.install_destination_path:
push eax
call fcn.00403540
cmp dword [ebp - 0xb88], 8
pop ecx
pop ecx
mov ecx, dword [ebp - 0xb9c]
jae 0x43872e
lea ecx, [ebp - 0xb9c]
push ecx
push eax
call fcn.0040b670
pop ecx
pop ecx
test byte [ebp - 0xc48], 2
je 0x438752
and dword [ebp - 0xc48], 0xfffffffd
lea ecx, [ebp - 0xb4]
call fcn.0040ae20
add esi, 0x28
push esi
lea eax, [ebp - 0xb9c]
push eax
lea eax, [ebp - 0xc28]
push eax
call fcn.0042e7e8
add esp, 0xc
lea eax, [ebp - 0xb2c]
push eax
push dword [ebp - 0xc50]
lea ecx, [ebp - 0xc0c]
call fcn.00401f50
mov ecx, eax
call fcn.004019c0
push eax
lea eax, [ebp - 0xc28]
push eax
call fcn.0040e190
pop ecx
pop ecx
lea ecx, [ebp - 0xb2c]
call fcn.00401f80
lea ecx, [ebp - 0xc0c]
call fcn.00401f80
lea ecx, [ebp - 0xbf0]
call fcn.00417fc0
lea ecx, [ebp - 0xb80]
call fcn.00417fc0
lea eax, [ebp - 0xb80]
push eax
call fcn.004054b0
pop ecx
push 7
pop esi
test al, al
jne 0x438832
call fcn.0040ab90
cmp eax, 2
jg 0x43880e
or dword [ebp - 0xc48], 4
push 2
push 0x2a9
push edi
lea ecx, [ebp - 0xb4]
call fcn.0040add0
add eax, 8
push str.Failed_to_create_temporary_file_for_setup.exe.
push eax
call fcn.00403540
pop ecx
pop ecx
test byte [ebp - 0xc48], 4
je 0x438b02
and dword [ebp - 0xc48], 0xfffffffb
lea ecx, [ebp - 0xb4]
call fcn.0040ae20
jmp 0x438b02
lea eax, [ebp - 0xb10]
push eax
lea ecx, [ebp - 0xb80]
call fcn.00401c50
cmp dword [ebp - 0xc14], 8
mov eax, dword [ebp - 0xc28]
jae 0x438859
lea eax, [ebp - 0xc28]
cmp dword [ebp - 0xafc], 8
mov ebx, dword [ebp - 0xb10]
jae 0x43886e
lea ebx, [ebp - 0xb10]
movzx eax, word [eax]
push eax
call fcn.0046e8e7
movzx ecx, word [ebx]
push ecx
mov word [ebp - 0xc4e], ax
call fcn.0046e8e7
pop ecx
pop ecx
cmp word [ebp - 0xc4e], ax
je 0x438a15
lea eax, [ebp - 0xb80]
push eax
lea ecx, [ebp - 0xbf0]
call fcn.00401490
push dword [ebp - 0xc54]
lea eax, [ebp - 0xc0c]
push eax
call fcn.004403d6
push eax
lea eax, [ebp - 0xb2c]
push eax
call fcn.00401c80
add esp, 0x10
push eax
lea ecx, [ebp - 0xb80]
call fcn.00401490
lea ecx, [ebp - 0xb2c]
call fcn.00401f80
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0xc0c]
call fcn.00402b70
lea eax, [ebp - 0xb2c]
push eax
lea ecx, [ebp - 0xb80]
call fcn.004018f0
push eax
lea ecx, [ebp - 0xb80]
call fcn.00401490
lea ecx, [ebp - 0xb2c]
call fcn.00401f80
lea eax, [ebp - 0xb2c]
push eax
lea ecx, [ebp - 0xb80]
call fcn.004018f0
push eax
lea ecx, [ebp - 0xb80]
call fcn.00401490
lea ecx, [ebp - 0xb2c]
call fcn.00401f80
lea eax, [ebp - 0xb2c]
push eax
lea ecx, [ebp - 0xb80]
call fcn.004018f0
push eax
lea ecx, [ebp - 0xb80]
call fcn.00401490
lea ecx, [ebp - 0xb2c]
call fcn.00401f80
xor eax, eax
push 0xc6
mov word [ebp - 0xcc], ax
lea eax, [ebp - 0xca]
push ebx
push eax
call fcn.0046e0e0
add esp, 0xc
call fcn.00470977
push eax
call fcn.00470977
push eax
push str._d__d.tmp
push 0xffffffffffffffff
lea eax, [ebp - 0xcc]
push 0x64
push eax
call fcn.0046f91d
xor eax, eax
mov word [ebp - 0xb64], ax
add esp, 0x18
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0xb64]
mov dword [ebp - 0xb50], esi
mov dword [ebp - 0xb54], ebx
call fcn.00401fb0
lea eax, [ebp - 0xb64]
push eax
lea eax, [ebp - 0xb2c]
push eax
lea ecx, [ebp - 0xb80]
call fcn.00401a30
push eax
lea ecx, [ebp - 0xb80]
call fcn.00401490
lea ecx, [ebp - 0xb2c]
call fcn.00401f80
push ebx
push 1
lea ecx, [ebp - 0xb64]
call fcn.00402b70
jmp 0x438a17
xor ebx, ebx
lea eax, [ebp - 0xc28]
push eax
lea eax, [ebp - 0xb48]
push eax
call fcn.00401c80
lea eax, [ebp - 0xb80]
push eax
lea eax, [ebp - 0xb48]
push eax
call fcn.004046f0
add esp, 0x10
test al, al
jne 0x438ae9
call fcn.0040ab90
test eax, eax
jg 0x438ace
or dword [ebp - 0xc48], 8
push ebx
push 0x2c2
push edi
lea ecx, [ebp - 0xb4]
call fcn.0040add0
add eax, 8
push str.move_setup_from_:
push eax
call fcn.00403540
cmp dword [ebp - 0xb34], 8
pop ecx
pop ecx
mov ecx, dword [ebp - 0xb48]
jae 0x438a8f
lea ecx, [ebp - 0xb48]
push ecx
push eax
call fcn.0040b670
push str._to:
push eax
call fcn.00403540
mov ecx, dword [ebp - 0xb80]
add esp, 0x10
cmp dword [ebp - 0xb6c], 8
jae 0x438ab9
lea ecx, [ebp - 0xb80]
push ecx
push eax
call fcn.0040b670
push str.failed.
push eax
call fcn.00403540
add esp, 0x10
test byte [ebp - 0xc48], 8
je 0x438ae9
and dword [ebp - 0xc48], 0xfffffff7
lea ecx, [ebp - 0xb4]
call fcn.0040ae20
lea ecx, [ebp - 0xb48]
call fcn.00401f80
push ebx
push 1
lea ecx, [ebp - 0xb10]
call fcn.00402b70
lea ecx, [ebp - 0xbb8]
call fcn.00417fc0
mov byte [ebp - 0xc49], bl
call fcn.0043d193
test al, al
jne 0x439026
xor eax, eax
lea ecx, [ebp - 0xb64]
mov word [ebp - 0x2d4], ax
call fcn.00417fc0
push 0x104
lea eax, [ebp - 0x2d4]
push eax
push str.CHROME_INSTALL_DIR
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x438d4d
xor eax, eax
mov word [ebp - 0xb48], ax
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0xb48]
mov dword [ebp - 0xb34], esi
mov dword [ebp - 0xb38], ebx
call fcn.00401fb0
cmp dword [ebp - 0xb38], 2
jne 0x438bd4
cmp dword [ebp - 0xb34], 8
mov eax, dword [ebp - 0xb48]
jae 0x438b98
lea eax, [ebp - 0xb48]
cmp word [eax + 2], 0x3a
jne 0x438bd4
push 0x49b76c
lea eax, [ebp - 0xb48]
push eax
lea eax, [ebp - 0xb2c]
push eax
call fcn.0042e514
add esp, 0xc
push eax
lea ecx, [ebp - 0xb48]
call fcn.00403920
push ebx
push 1
lea ecx, [ebp - 0xb2c]
call fcn.00402b70
lea eax, [ebp - 0xb48]
push eax
lea ecx, [ebp - 0xb2c]
call fcn.00401f50
push eax
lea ecx, [ebp - 0xb64]
call fcn.00401490
lea ecx, [ebp - 0xb2c]
call fcn.00401f80
xor eax, eax
push 0x49127c
lea ecx, [ebp - 0xb10]
mov dword [ebp - 0xafc], esi
mov dword [ebp - 0xb00], ebx
mov word [ebp - 0xb10], ax
call fcn.00401fb0
lea eax, [ebp - 0xb10]
push eax
lea eax, [ebp - 0xb2c]
push eax
lea ecx, [ebp - 0xb64]
call fcn.00401a30
push eax
lea ecx, [ebp - 0xb64]
call fcn.00401490
lea ecx, [ebp - 0xb2c]
call fcn.00401f80
push ebx
push 1
lea ecx, [ebp - 0xb10]
call fcn.00402b70
xor eax, eax
push 0x48f860
lea ecx, [ebp - 0xb10]
mov dword [ebp - 0xafc], esi
mov dword [ebp - 0xb00], ebx
mov word [ebp - 0xb10], ax
call fcn.00401fb0
lea eax, [ebp - 0xb10]
push eax
lea eax, [ebp - 0xb2c]
push eax
lea ecx, [ebp - 0xb64]
call fcn.00401a30
push eax
lea ecx, [ebp - 0xb64]
call fcn.00401490
lea ecx, [ebp - 0xb2c]
call fcn.00401f80
push ebx
push 1
lea ecx, [ebp - 0xb10]
call fcn.00402b70
xor eax, eax
push 0x48f834
lea ecx, [ebp - 0xb10]
mov dword [ebp - 0xafc], esi
mov dword [ebp - 0xb00], ebx
mov word [ebp - 0xb10], ax
call fcn.00401fb0
lea eax, [ebp - 0xb10]
push eax
lea eax, [ebp - 0xb2c]
push eax
lea ecx, [ebp - 0xb64]
call fcn.00401a30
push eax
lea ecx, [ebp - 0xb64]
call fcn.00401490
lea ecx, [ebp - 0xb2c]
call fcn.00401f80
push ebx
push 1
lea ecx, [ebp - 0xb10]
call fcn.00402b70
lea eax, [ebp - 0xb64]
push eax
lea ecx, [ebp - 0xbb8]
call fcn.00401490
mov byte [ebp - 0xc49], 1
push ebx
push 1
lea ecx, [ebp - 0xb48]
call fcn.00402b70
lea ecx, [ebp - 0xb64]
call fcn.00401f80
cmp byte [ebp - 0xc49], bl
je 0x439026
cmp byte [ebp + 0x18], bl
je 0x438f37
xor eax, eax
push str.Default
lea ecx, [ebp - 0xb10]
mov dword [ebp - 0xafc], esi
mov dword [ebp - 0xb00], ebx
mov word [ebp - 0xb10], ax
call fcn.00401fb0
lea eax, [ebp - 0xb10]
push eax
lea eax, [ebp - 0xc44]
push eax
lea ecx, [ebp - 0xbb8]
call fcn.00401a30
push ebx
push 1
lea ecx, [ebp - 0xb10]
call fcn.00402b70
xor eax, eax
push str.Preferences
lea ecx, [ebp - 0xb10]
mov dword [ebp - 0xafc], esi
mov dword [ebp - 0xb00], ebx
mov word [ebp - 0xb10], ax
call fcn.00401fb0
lea eax, [ebp - 0xb10]
push eax
lea eax, [ebp - 0xb64]
push eax
lea ecx, [ebp - 0xc44]
call fcn.00401a30
push eax
lea ecx, [ebp - 0xc44]
call fcn.00401490
lea ecx, [ebp - 0xb64]
call fcn.00401f80
push ebx
push 1
lea ecx, [ebp - 0xb10]
call fcn.00402b70
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebp - 0xb48]
push eax
call fcn.00438507
mov eax, dword [ebp - 0xb38]
pop ecx
pop ecx
cmp eax, ebx
je 0x438f1e
cmp dword [ebp - 0xb34], 0x10
mov ecx, dword [ebp - 0xb48]
jae 0x438e54
lea ecx, [ebp - 0xb48]
mov dword [ebp - 0xc54], eax
lea eax, [ebp - 0xc58]
push eax
lea eax, [ebp - 0xb10]
push eax
mov dword [ebp - 0xc58], ecx
call fcn.00413100
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0xb64]
call fcn.00401f50
push ebx
push 1
lea ecx, [ebp - 0xb10]
call fcn.00402b70
xor eax, eax
push str.Cache
lea ecx, [ebp - 0xb10]
mov dword [ebp - 0xafc], esi
mov dword [ebp - 0xb00], ebx
mov word [ebp - 0xb10], ax
call fcn.00401fb0
lea eax, [ebp - 0xb10]
push eax
lea eax, [ebp - 0xbd4]
push eax
lea ecx, [ebp - 0xb64]
call fcn.00401a30
push eax
lea ecx, [ebp - 0xb64]
call fcn.00401490
lea ecx, [ebp - 0xbd4]
call fcn.00401f80
push ebx
push 1
lea ecx, [ebp - 0xb10]
call fcn.00402b70
lea eax, [ebp - 0xb64]
push eax
call fcn.00404eb0
pop ecx
test al, al
je 0x438f13
lea eax, [ebp - 0xb64]
push 1
push eax
call fcn.00404360
pop ecx
pop ecx
lea ecx, [ebp - 0xb64]
call fcn.00401f80
push ebx
push 1
lea ecx, [ebp - 0xb48]
call fcn.00402540
lea ecx, [ebp - 0xc44]
call fcn.00401f80
xor eax, eax
push str.Local_State
lea ecx, [ebp - 0xb10]
mov dword [ebp - 0xafc], esi
mov dword [ebp - 0xb00], ebx
mov word [ebp - 0xb10], ax
call fcn.00401fb0
lea eax, [ebp - 0xb10]
push eax
lea eax, [ebp - 0xb2c]
push eax
lea ecx, [ebp - 0xbb8]
call fcn.00401a30
push ebx
push 1
lea ecx, [ebp - 0xb10]
call fcn.00402b70
push dword [ebp - 0xc5c]
lea eax, [ebp - 0xc0c]
push eax
call fcn.00401c80
lea eax, [ebp - 0xc0c]
push eax
call fcn.004054b0
add esp, 0xc
test al, al
jne 0x438ff9
call fcn.0040ab90
cmp eax, 2
jg 0x438fdc
or dword [ebp - 0xc48], 0x10
push 2
push 0x2fb
push edi
lea ecx, [ebp - 0xb4]
call fcn.0040add0
add eax, 8
push str.Failed_to_create_temporary_file_for_Local_State.
push eax
call fcn.00403540
pop ecx
pop ecx
test byte [ebp - 0xc48], 0x10
je 0x43900e
and dword [ebp - 0xc48], 0xffffffef
lea ecx, [ebp - 0xb4]
call fcn.0040ae20
jmp 0x43900e
lea eax, [ebp - 0xc0c]
push eax
lea eax, [ebp - 0xb2c]
push eax
call fcn.00404820
pop ecx
pop ecx
lea ecx, [ebp - 0xc0c]
call fcn.00401f80
lea ecx, [ebp - 0xb2c]
call fcn.00401f80
jmp 0x439075
call fcn.0040ab90
cmp eax, 2
jg 0x43905a
or dword [ebp - 0xc48], 0x20
push 2
push 0x301
push edi
lea ecx, [ebp - 0xb4]
call fcn.0040add0
add eax, 8
push str.Could_not_retrieve_users_profile_directory.
push eax
call fcn.00403540
pop ecx
pop ecx
test byte [ebp - 0xc48], 0x20
je 0x439075
and dword [ebp - 0xc48], 0xffffffdf
lea ecx, [ebp - 0xb4]
call fcn.0040ae20
mov dword [ebp - 0xc54], ebx
call fcn.0040ab90
test eax, eax
jg 0x4390cb
or dword [ebp - 0xc48], 0x40
push ebx
push 0x307
push edi
lea ecx, [ebp - 0xb4]
call fcn.0040add0
add eax, 8
push str.Deleting_install_path
push eax
call fcn.00403540
cmp dword [ebp - 0xb88], 8
pop ecx
pop ecx
mov ecx, dword [ebp - 0xb9c]
jae 0x4390c2
lea ecx, [ebp - 0xb9c]
push ecx
push eax
call fcn.0040b670
pop ecx
pop ecx
test byte [ebp - 0xc48], 0x40
je 0x4390e6
and dword [ebp - 0xc48], 0xffffffbf
lea ecx, [ebp - 0xb4]
call fcn.0040ae20
or dword [ebp - 0xc48], 0x80
push 1
lea eax, [ebp - 0xb9c]
push eax
lea ecx, [ebp - 0xb2c]
call fcn.00401f50
push eax
call fcn.00404360
pop ecx
pop ecx
mov esi, pe_nt_image_headers32
test al, al
jne 0x43913f
or dword [ebp - 0xc48], esi
lea eax, [ebp - 0xb9c]
push eax
lea ecx, [ebp - 0xbd4]
call fcn.00401f50
push eax
call fcn.00404ed0
pop ecx
mov byte [ebp - 0xc4d], 1
test al, al
jne 0x439145
mov byte [ebp - 0xc4d], bl
test dword [ebp - 0xc48], esi
je 0x439162
and dword [ebp - 0xc48], 0xfffffeff
lea ecx, [ebp - 0xbd4]
call fcn.00401f80
test byte [ebp - 0xc48], 0x80
je 0x439180
and dword [ebp - 0xc48], 0xffffff7f
lea ecx, [ebp - 0xb2c]
call fcn.00401f80
cmp byte [ebp - 0xc4d], bl
je 0x439277
call fcn.0043d193
test al, al
je 0x4391c0
cmp dword [ebp - 0xb88], 8
mov eax, dword [ebp - 0xb9c]
jae 0x4391aa
lea eax, [ebp - 0xb9c]
push eax
call fcn.0044afa6
pop ecx
mov dword [ebp - 0xc54], 2
jmp 0x439277
push 1
call fcn.00435b95
pop ecx
push 1
lea eax, [ebp - 0xb9c]
mov esi, 0x200
or dword [ebp - 0xc48], esi
push eax
lea ecx, [ebp - 0xb2c]
call fcn.00401f50
push eax
call fcn.00404360
pop ecx
pop ecx
test al, al
jne 0x439221
or dword [ebp - 0xc48], 0x400
lea eax, [ebp - 0xb9c]
push eax
lea ecx, [ebp - 0xbd4]
call fcn.00401f50
push eax
call fcn.00404ed0
pop ecx
mov byte [ebp - 0xc4d], 1
test al, al
jne 0x439227
mov byte [ebp - 0xc4d], bl
test dword [ebp - 0xc48], 0x400
je 0x439248
and dword [ebp - 0xc48], 0xfffffbff
lea ecx, [ebp - 0xbd4]
call fcn.00401f80
test dword [ebp - 0xc48], esi
je 0x439265
and dword [ebp - 0xc48], 0xfffffdff
lea ecx, [ebp - 0xb2c]
call fcn.00401f80
cmp byte [ebp - 0xc4d], bl
je 0x439277
mov dword [ebp - 0xc54], 1
cmp byte [ebp + 0x18], bl
je 0x4393de
cmp byte [ebp - 0xc49], bl
je 0x4393de
call fcn.0040ab90
mov esi, 0x800
test eax, eax
jg 0x4392e0
or dword [ebp - 0xc48], esi
push ebx
push 0x321
push edi
lea ecx, [ebp - 0xb4]
call fcn.0040add0
add eax, 8
push str.Deleting_user_profile
push eax
call fcn.00403540
cmp dword [ebp - 0xba4], 8
pop ecx
pop ecx
mov ecx, dword [ebp - 0xbb8]
jae 0x4392d7
lea ecx, [ebp - 0xbb8]
push ecx
push eax
call fcn.0040b670
pop ecx
pop ecx
test dword [ebp - 0xc48], esi
je 0x4392fd
and dword [ebp - 0xc48], 0xfffff7ff
lea ecx, [ebp - 0xb4]
call fcn.0040ae20
lea eax, [ebp - 0xbb8]
push 1
push eax
call fcn.00404360
pop ecx
pop ecx
test al, al
jne 0x4393b9
call fcn.0040ab90
mov esi, 0x1000
cmp eax, 2
jg 0x43936b
or dword [ebp - 0xc48], esi
push 2
push 0x323
push edi
lea ecx, [ebp - 0xb4]
call fcn.0040add0
add eax, 8
push str.Failed_to_delete_user_profile_dir:
push eax
call fcn.00403540
cmp dword [ebp - 0xba4], 8
pop ecx
pop ecx
mov ecx, dword [ebp - 0xbb8]
jae 0x439362
lea ecx, [ebp - 0xbb8]
push ecx
push eax
call fcn.0040b670
pop ecx
pop ecx
test dword [ebp - 0xc48], esi
je 0x43937e
lea ecx, [ebp - 0xb4]
call fcn.0040ae20
call fcn.0043d193
test al, al
je 0x4393af
cmp dword [ebp - 0xba4], 8
mov eax, dword [ebp - 0xbb8]
jae 0x43939c
lea eax, [ebp - 0xbb8]
push eax
call fcn.0044afa6
pop ecx
mov dword [ebp - 0xc54], 2
jmp 0x4393c2
mov dword [ebp - 0xc54], 1
cmp dword [ebp - 0xc54], 2
jne 0x4393d1
lea eax, [ebp - 0xbb8]
push eax
call fcn.004355b9
pop ecx
jmp 0x4393e7
lea eax, [ebp - 0xbb8]
push eax
call fcn.004356f8
pop ecx
cmp dword [ebp - 0xc54], 2
jne 0x439401
lea eax, [ebp - 0xb9c]
push eax
lea ecx, [ebp - 0xbd4]
call fcn.00401f50
push eax
call fcn.004355b9
jmp 0x439419
lea eax, [ebp - 0xb9c]
push eax
lea ecx, [ebp - 0xbd4]
call fcn.00401f50
push eax
call fcn.004356f8
pop ecx
lea ecx, [ebp - 0xbd4]
call fcn.00401f80
cmp dword [ebp - 0xbe0], ebx
je 0x43952b
lea eax, [ebp - 0xbf0]
push eax
lea eax, [ebp - 0xb80]
push eax
call fcn.004046f0
pop ecx
pop ecx
test al, al
je 0x43952b
xor eax, eax
push 0x81e
mov word [ebp - 0xaf4], ax
lea eax, [ebp - 0xaf2]
push ebx
push eax
call fcn.0046e0e0
add esp, 0xc
lea eax, [ebp - 0xbd4]
push eax
lea ecx, [ebp - 0xb80]
call fcn.00401c50
cmp dword [eax + 0x14], 8
jb 0x439488
mov edi, dword [eax]
jmp 0x43948a
mov edi, eax
cmp dword [ebp - 0xbdc], 8
mov esi, dword [ebp - 0xbf0]
jae 0x43949f
lea esi, [ebp - 0xbf0]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push edi
push esi
push str._s___del_setup_exe__s____origin_setup_exe_handle_d
push 0xffffffffffffffff
lea eax, [ebp - 0xaf4]
push 0x410
push eax
call fcn.0046f91d
add esp, 0x1c
push ebx
push 1
lea ecx, [ebp - 0xbd4]
call fcn.00402b70
push 0x40
lea eax, [ebp - 0xc9c]
push ebx
push eax
call fcn.0046e0e0
xor eax, eax
mov dword [ebp - 0xb3c], ebx
lea edi, [ebp - 0xb38]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xb3c]
push eax
lea eax, [ebp - 0xca0]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0xaf4]
push eax
push ebx
mov dword [ebp - 0xca0], 0x44
mov dword [ebp - 0xc74], 0x81
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea ecx, [ebp - 0xbb8]
call fcn.00401f80
lea ecx, [ebp - 0xb80]
call fcn.00401f80
lea ecx, [ebp - 0xbf0]
call fcn.00401f80
push ebx
push 1
lea ecx, [ebp - 0xc28]
call fcn.00402b70
mov esi, dword [ebp - 0xc54]
pop edi
jmp 0x4386c0