Function at 0x40ac80
Capabilities:
Check if file exists
Delete file
Delete registry key
Get common file path
Move file
Persist via windows service
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c76af
mov eax, dword fs:[0]
push eax
mov eax, 0x1670
call fcn.004939a0
mov eax, dword [0x50545c]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x15f8], ecx
mov dword [ebp - 0x133c], 0
push str.DoUpdate_Enter...
call fcn.0042fb40
add esp, 4
mov ecx, dword [ebp - 0x15f8]
call fcn.00402f10
mov ecx, dword [ebp - 0x15f8]
call fcn.00402fb0
cmp dword [ebp + 8], 0
jne 0x40acf4
mov dword [ebp - 0x1340], 0
jmp 0x40ad06
mov eax, dword [ebp + 8]
push eax
call fcn.004939fc
add esp, 4
mov dword [ebp - 0x1340], eax
mov ecx, dword [ebp - 0x1340]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x15f8]
call fcn.00412d00
mov eax, dword [ebp - 0x15f8]
add eax, 4
mov dword [ebp - 0x1348], eax
cmp dword [ebp + 0xc], 0
jne 0x40ad3d
mov dword [ebp - 0x1344], 0
jmp 0x40ad4f
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004939fc
add esp, 4
mov dword [ebp - 0x1344], eax
mov edx, dword [ebp - 0x1344]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1348]
call fcn.00412d00
push 0x104
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x15f8]
add edx, 0x10
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [ebp - 0x14], 0
mov ecx, 0x506c08
call fcn.0043cbb0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xa78], 0
cmp dword [ebp + 0x14], 0
je 0x40adb1
mov dword [ebp - 0xa78], 1
jmp 0x40ae73
mov dword [ebp - 0xa90], 0
jmp 0x40adcc
mov eax, dword [ebp - 0xa90]
add eax, 1
mov dword [ebp - 0xa90], eax
cmp dword [ebp - 0xa90], 2
jge 0x40ae73
lea ecx, [ebp - 0x12b4]
push ecx
mov ecx, 0x506c08
call fcn.00432f50
mov dword [ebp - 0x15fc], eax
mov edx, dword [ebp - 0x15fc]
mov dword [ebp - 0x1600], edx
mov dword [ebp - 4], 0
push 0x4093e0
mov eax, dword [ebp - 0x15f8]
push eax
mov ecx, dword [ebp - 0x1600]
push ecx
mov ecx, 0x506c08
call fcn.00441450
mov dword [ebp - 0xa94], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12b4]
call fcn.004129d0
mov edx, dword [ebp - 0xa94]
push edx
push str.DoUpdate_Call_Decompression_Retval___d.
call fcn.0042fb40
add esp, 8
cmp dword [ebp - 0xa94], 0
jne 0x40ae6e
mov dword [ebp - 0xa78], 1
push str.DoUpdate_Call_Decompression_Succeed_
call fcn.0042fb40
add esp, 4
jmp 0x40ae73
jmp 0x40adbd
cmp dword [ebp - 0xa78], 0
jne 0x40ae95
push str.DoUpdate_Call_Decompression_Fail_
call fcn.0042fb40
add esp, 4
mov dword [ebp - 0x14], 2
jmp 0x40bfe3
mov ecx, dword [ebp - 0x15f8]
call fcn.00401db0
test eax, eax
jne 0x40aeb1
push str.DoUpdate_Call_StopFileLockProtect_Fail_
call fcn.0042fb40
add esp, 4
mov eax, dword [ebp - 0x15f8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1350], ecx
mov edx, dword [ebp - 0x1350]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40b052
mov eax, dword [ebp - 0x15f8]
mov ecx, dword [eax + 4]
push ecx
push str.DoUpdate_Patch_Dir_Not_Exists___s_
call fcn.0042fb40
add esp, 8
mov dword [ebp - 0xaa4], 3
mov edx, dword [ebp - 0x15f8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xa9c], eax
cmp dword [ebp - 0xa9c], 0
jne 0x40af1d
mov dword [ebp - 0x1604], 0
jmp 0x40aff3
mov ecx, dword [ebp - 0xa9c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xa98], eax
cmp dword [ebp - 0xa98], 0x3fffffff
jle 0x40af4e
mov dword [ebp - 0x1608], 0
jmp 0x40afe7
mov eax, dword [ebp - 0xa98]
shl eax, 1
call fcn.004939d0
mov dword [ebp - 0x1358], esp
mov edx, dword [ebp - 0x135c]
mov dword [ebp - 0x1608], edx
cmp dword [ebp - 0x1358], 0
je 0x40af7f
cmp dword [ebp - 0xa9c], 0
jne 0x40af8b
mov dword [ebp - 0x1608], 0
jmp 0x40afe7
mov eax, dword [ebp - 0x1358]
mov byte [eax], 0
push 0
push 0
mov ecx, dword [ebp - 0xa98]
shl ecx, 1
push ecx
mov edx, dword [ebp - 0x1358]
push edx
push 0xffffffffffffffff
mov eax, dword [ebp - 0xa9c]
push eax
push 0
mov ecx, dword [ebp - 0xaa4]
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1354], eax
cmp dword [ebp - 0x1354], 0
jne 0x40afdb
mov dword [ebp - 0x1608], 0
jmp 0x40afe7
mov edx, dword [ebp - 0x1358]
mov dword [ebp - 0x1608], edx
mov eax, dword [ebp - 0x1608]
mov dword [ebp - 0x1604], eax
mov ecx, dword [ebp - 0x1604]
push ecx
call dword [sym.imp.imagehlp.dll_MakeSureDirectoryPathExists]
mov dword [ebp - 0xaa0], eax
cmp dword [ebp - 0xaa0], 0
je 0x40b028
mov edx, dword [ebp - 0x15f8]
mov eax, dword [edx + 4]
push eax
push str.DoUpdate_MakeSureDirectoryPathExists_Succeed___s.
call fcn.0042fb40
add esp, 8
jmp 0x40b052
mov ecx, dword [ebp - 0x15f8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DoUpdate_MakeSureDirectoryPathExists_Fail__LastError__d___s.
call fcn.0042fb40
add esp, 0xc
mov dword [ebp - 0x14], 8
jmp 0x40bfe3
mov ecx, dword [ebp - 0x15f8]
call fcn.00403770
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40b074
mov ecx, dword [ebp - 0x15f8]
call fcn.00403770
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40b090
mov eax, dword [ebp - 0x14]
push eax
push str.DoUpdate_Call_UpdateDrivers_Fail__Return_Value__d__
call fcn.0042fb40
add esp, 8
jmp 0x40bfe3
mov ecx, dword [ebp - 0x15f8]
call fcn.00402db0
mov ecx, dword [ebp - 0x15f8]
call fcn.00402a10
mov ecx, 0x506c08
call fcn.00442180
mov ecx, 0x506c08
call fcn.00442d50
mov ecx, dword [ebp - 0x15f8]
call fcn.0040c3e0
lea ecx, [ebp - 0x12b8]
push ecx
mov ecx, 0x506c08
call fcn.00432f50
mov dword [ebp - 0x160c], eax
mov edx, dword [ebp - 0x160c]
mov dword [ebp - 0x1610], edx
mov dword [ebp - 4], 1
push str.config.ini
mov eax, dword [ebp - 0x1610]
push eax
lea ecx, [ebp - 0x12bc]
push ecx
call fcn.0040f270
add esp, 0xc
mov dword [ebp - 0x1614], eax
mov edx, dword [ebp - 0x1614]
mov dword [ebp - 0x1360], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x1360]
mov ecx, dword [eax]
mov dword [ebp - 0x1364], ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x1364]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x15f8]
call fcn.0040c110
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12bc]
call fcn.004129d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12b8]
call fcn.004129d0
push str.Update_EstSysSet.ini__path_is_
lea ecx, [ebp - 0x12c0]
call fcn.00412290
mov dword [ebp - 0x1618], eax
mov edx, dword [ebp - 0x1618]
mov dword [ebp - 0x161c], edx
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x15f8]
push eax
mov ecx, dword [ebp - 0x161c]
push ecx
lea edx, [ebp - 0x12c4]
push edx
call fcn.0040f190
add esp, 0xc
mov dword [ebp - 0x1620], eax
mov eax, dword [ebp - 0x1620]
mov dword [ebp - 0x1624], eax
mov byte [ebp - 4], 4
push 0x4d4bb8
mov ecx, dword [ebp - 0x1624]
push ecx
lea edx, [ebp - 0x12c8]
push edx
call fcn.0040f270
add esp, 0xc
mov dword [ebp - 0x1628], eax
mov eax, dword [ebp - 0x1628]
mov dword [ebp - 0x1378], eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x1378]
mov edx, dword [ecx]
mov dword [ebp - 0x137c], edx
mov eax, dword [ebp - 0x137c]
push eax
call fcn.00442d80
add esp, 4
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x12c8]
call fcn.004129d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x12c4]
call fcn.004129d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c0]
call fcn.004129d0
push 0x4d4bb8
mov ecx, dword [ebp - 0x15f8]
push ecx
lea edx, [ebp - 0x12cc]
push edx
call fcn.0040f270
add esp, 0xc
mov dword [ebp - 0x138c], eax
mov eax, dword [ebp - 0x138c]
mov ecx, dword [eax]
mov dword [ebp - 0x1390], ecx
mov edx, dword [ebp - 0x1390]
push edx
push 0x4d4bb4
push str.Regist
push str.IsRegist
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x12cc]
call fcn.004129d0
mov ecx, dword [ebp - 0x15f8]
call fcn.00409740
mov dword [ebp - 0xa88], 1
push str.C:Program_FilesEsafeNetCobra_DocGuard_ClientEstDeskTop
lea ecx, [ebp - 0x854]
call fcn.00412290
mov dword [ebp - 4], 6
mov eax, dword [ebp - 0x854]
mov dword [ebp - 0x13a0], eax
mov ecx, dword [ebp - 0x13a0]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40b2ec
mov dword [ebp - 0xa88], 0
xor edx, edx
mov word [ebp - 0x84c], dx
push 0x206
push 0
lea eax, [ebp - 0x84a]
push eax
call fcn.004931a0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x84c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [ebp - 0x84c]
push edx
lea ecx, [ebp - 0x22c]
call fcn.00412290
mov byte [ebp - 4], 7
push 0x208
push 0
lea eax, [ebp - 0x84c]
push eax
call fcn.004931a0
add esp, 0xc
push str.System32Dynamicdll64.dll
mov ecx, dword [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x84c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x84c]
push eax
lea ecx, [ebp - 0x858]
call fcn.00412290
mov byte [ebp - 4], 8
push 0x208
push 0
lea ecx, [ebp - 0x84c]
push ecx
call fcn.004931a0
add esp, 0xc
push str.SysWOW64Dynamicdll.dll
mov edx, dword [ebp - 0x22c]
push edx
lea eax, [ebp - 0x84c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0x84c]
push ecx
lea ecx, [ebp - 0xa84]
call fcn.00412290
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x858]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 4
push 0
mov eax, dword [ebp - 0x858]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0xa84]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 4
push 0
mov edx, dword [ebp - 0xa84]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push str.ProcessCtr.sys
mov eax, dword [ebp - 0x15f8]
push eax
lea ecx, [ebp - 0x12d0]
push ecx
call fcn.0040f270
add esp, 0xc
mov dword [ebp - 0x13bc], eax
mov edx, dword [ebp - 0x13bc]
mov eax, dword [edx]
mov dword [ebp - 0x13c0], eax
mov ecx, dword [ebp - 0x13c0]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x12d0]
call fcn.004129d0
push str.ProcessCtr64.sys
mov edx, dword [ebp - 0x15f8]
push edx
lea eax, [ebp - 0x12d4]
push eax
call fcn.0040f270
add esp, 0xc
mov dword [ebp - 0x13c8], eax
mov ecx, dword [ebp - 0x13c8]
mov edx, dword [ecx]
mov dword [ebp - 0x13cc], edx
mov eax, dword [ebp - 0x13cc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x12d4]
call fcn.004129d0
push str.ProcessCtrl.dll
mov ecx, dword [ebp - 0x15f8]
push ecx
lea edx, [ebp - 0x12d8]
push edx
call fcn.0040f270
add esp, 0xc
mov dword [ebp - 0x13d4], eax
mov eax, dword [ebp - 0x13d4]
mov ecx, dword [eax]
mov dword [ebp - 0x13d8], ecx
mov edx, dword [ebp - 0x13d8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x12d8]
call fcn.004129d0
push str.ProcessCtrl64.dll
mov eax, dword [ebp - 0x15f8]
push eax
lea ecx, [ebp - 0x12dc]
push ecx
call fcn.0040f270
add esp, 0xc
mov dword [ebp - 0x13e0], eax
mov edx, dword [ebp - 0x13e0]
mov eax, dword [edx]
mov dword [ebp - 0x13e4], eax
mov ecx, dword [ebp - 0x13e4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x12dc]
call fcn.004129d0
push str.SYSTEMCurrentControlSet_servicesProcessCtr
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push str.ProcessCtrl64__.sys
mov edx, dword [ebp - 0x15f8]
push edx
lea eax, [ebp - 0x12e0]
push eax
call fcn.0040f270
add esp, 0xc
mov dword [ebp - 0x13ec], eax
mov ecx, dword [ebp - 0x13ec]
mov edx, dword [ecx]
mov dword [ebp - 0x13f0], edx
mov eax, dword [ebp - 0x13f0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x12e0]
call fcn.004129d0
push str.ProcessCtrl__.sys
mov ecx, dword [ebp - 0x15f8]
push ecx
lea edx, [ebp - 0x12e4]
push edx
call fcn.0040f270
add esp, 0xc
mov dword [ebp - 0x13f8], eax
mov eax, dword [ebp - 0x13f8]
mov ecx, dword [eax]
mov dword [ebp - 0x13fc], ecx
mov edx, dword [ebp - 0x13fc]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x12e4]
call fcn.004129d0
push str.ProcessCtrl64__.sys
mov eax, dword [ebp - 0x15f8]
push eax
lea ecx, [ebp - 0x12e8]
push ecx
call fcn.0040f270
add esp, 0xc
mov dword [ebp - 0x162c], eax
mov edx, dword [ebp - 0x162c]
mov dword [ebp - 0x1404], edx
mov byte [ebp - 4], 0xa
push str.ProcessCtrl64.sys
mov eax, dword [ebp - 0x15f8]
push eax
lea ecx, [ebp - 0x12ec]
push ecx
call fcn.0040f270
add esp, 0xc
mov dword [ebp - 0x140c], eax
mov edx, dword [ebp - 0x1404]
mov eax, dword [edx]
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x140c]
mov edx, dword [ecx]
mov dword [ebp - 0x1410], edx
mov eax, dword [ebp - 0x1408]
push eax
mov ecx, dword [ebp - 0x1410]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x12ec]
call fcn.004129d0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x12e8]
call fcn.004129d0
push str.ProcessCtrl64__.sys
mov edx, dword [ebp - 0x15f8]
push edx
lea eax, [ebp - 0x12f0]
push eax
call fcn.0040f270
add esp, 0xc
mov dword [ebp - 0x1630], eax
mov ecx, dword [ebp - 0x1630]
mov dword [ebp - 0x141c], ecx
mov byte [ebp - 4], 0xb
push str.ProcessCtrl64.sys
mov edx, dword [ebp - 0x15f8]
push edx
lea eax, [ebp - 0x12f4]
push eax
call fcn.0040f270
add esp, 0xc
mov dword [ebp - 0x1424], eax
mov ecx, dword [ebp - 0x141c]
mov edx, dword [ecx]
mov dword [ebp - 0x1420], edx
mov eax, dword [ebp - 0x1424]
mov ecx, dword [eax]
mov dword [ebp - 0x1428], ecx
mov edx, dword [ebp - 0x1420]
push edx
mov eax, dword [ebp - 0x1428]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x12f4]
call fcn.004129d0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x12f0]
call fcn.004129d0
push str.ProcessCtrl64__.sys
mov ecx, dword [ebp - 0x15f8]
push ecx
lea edx, [ebp - 0x12f8]
push edx
call fcn.0040f270
add esp, 0xc
mov dword [ebp - 0x1434], eax
mov eax, dword [ebp - 0x1434]
mov ecx, dword [eax]
mov dword [ebp - 0x1438], ecx
mov edx, dword [ebp - 0x1438]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x12f8]
call fcn.004129d0
push str.ProcessCtrl__.sys
mov eax, dword [ebp - 0x15f8]
push eax
lea ecx, [ebp - 0x12fc]
push ecx
call fcn.0040f270
add esp, 0xc
mov dword [ebp - 0x1440], eax
mov edx, dword [ebp - 0x1440]
mov eax, dword [edx]
mov dword [ebp - 0x1444], eax
mov ecx, dword [ebp - 0x1444]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x12fc]
call fcn.004129d0
push str.C:Program_FilesEsafeNetCobra_DocGuard_ClientEstConfig.ini
push 1
push str.STATE
push str.Permission
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0xa68], eax
cmp dword [ebp - 0xa68], 0
jne 0x40b833
push ecx
mov ecx, esp
mov dword [ebp - 0x1300], esp
push str.EstNewExchangeExt.dll
call fcn.00412290
mov dword [ebp - 0x1634], eax
mov ecx, dword [ebp - 0x15f8]
call fcn.00403390
push ecx
mov ecx, esp
mov dword [ebp - 0x1304], esp
push str.EstNewExchangeExt64.dll
call fcn.00412290
mov dword [ebp - 0x1638], eax
mov ecx, dword [ebp - 0x15f8]
call fcn.00403390
push ecx
mov ecx, esp
mov dword [ebp - 0x1308], esp
push str.EstMsAddinForClient.dll
call fcn.00412290
mov dword [ebp - 0x163c], eax
mov ecx, dword [ebp - 0x15f8]
call fcn.00403390
push ecx
mov ecx, esp
mov dword [ebp - 0x130c], esp
push str.EstMsAddinForClient64.dll
call fcn.00412290
mov dword [ebp - 0x1640], eax
mov ecx, dword [ebp - 0x15f8]
call fcn.00403390
mov ecx, dword [ebp - 0x15f8]
call fcn.00406180
test eax, eax
jne 0x40b8a9
mov ecx, dword [ebp - 0x15f8]
call fcn.00406180
test eax, eax
jne 0x40b8a9
mov dword [ebp - 0x14], 6
push str.DoUpdate_Call_CopyToUpdateDriectory_Fail_
call fcn.0042fb40
add esp, 4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa84]
call fcn.004129d0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x858]
call fcn.004129d0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x22c]
call fcn.004129d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x854]
call fcn.004129d0
jmp 0x40bfe3
mov edx, 1
test edx, edx
je 0x40bb72
push 0x4d1180
lea ecx, [ebp - 0xaac]
call fcn.00412290
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x1310]
push eax
mov ecx, 0x506c08
call fcn.00432f50
mov dword [ebp - 0x1644], eax
mov ecx, dword [ebp - 0x1644]
mov dword [ebp - 0x1648], ecx
mov byte [ebp - 4], 0xd
push str.clientEstConfig.ini
mov edx, dword [ebp - 0x1648]
push edx
lea eax, [ebp - 0x1314]
push eax
call fcn.0040f270
add esp, 0xc
mov dword [ebp - 0x164c], eax
mov ecx, dword [ebp - 0x164c]
mov dword [ebp - 0x14ac], ecx
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x14ac]
push edx
lea ecx, [ebp - 0xaac]
call fcn.00412a10
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1314]
call fcn.004129d0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1310]
call fcn.004129d0
cmp dword [ebp - 0x18], 0
je 0x40b9e4
lea eax, [ebp - 0x1318]
push eax
mov ecx, 0x506c08
call fcn.00432f50
mov dword [ebp - 0x1650], eax
mov ecx, dword [ebp - 0x1650]
mov dword [ebp - 0x1654], ecx
mov byte [ebp - 4], 0xf
push str.client_64EstConfig.ini
mov edx, dword [ebp - 0x1654]
push edx
lea eax, [ebp - 0x131c]
push eax
call fcn.0040f270
add esp, 0xc
mov dword [ebp - 0x1658], eax
mov ecx, dword [ebp - 0x1658]
mov dword [ebp - 0x14b8], ecx
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x14b8]
push edx
lea ecx, [ebp - 0xaac]
call fcn.00412a10
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x131c]
call fcn.004129d0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1318]
call fcn.004129d0
mov eax, dword [ebp - 0xaac]
mov dword [ebp - 0x14c4], eax
mov ecx, dword [ebp - 0x14c4]
push ecx
push 0
push str.VALUE
push str.MAILLOCK
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x40bb63
xor edx, edx
mov word [ebp - 0x12ac], dx
push 0x7fe
push 0
lea eax, [ebp - 0x12aa]
push eax
call fcn.004931a0
add esp, 0xc
mov ecx, dword [ebp - 0xaac]
push ecx
push 0x400
lea edx, [ebp - 0x12ac]
push edx
push 0x4d1180
push str.WHITELIST
push str.MAILLOCK
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x12ac]
push eax
call fcn.004939fc
add esp, 4
test eax, eax
jbe 0x40bb63
lea ecx, [ebp - 0x12b0]
push ecx
push 0x2011f
push 0
push str.SYSTEMCurrentControlSet_servicesmaillock
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40bac2
lea edx, [ebp - 0x12ac]
push edx
call fcn.004939fc
add esp, 4
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x12ac]
push ecx
push 1
push 0
push str.FilterRegex
mov edx, dword [ebp - 0x12b0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x12b0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str._UpdateMailLock__dcg_set_maillock_whitelist
lea ecx, [ebp - 0x1320]
call fcn.00412290
mov dword [ebp - 0x165c], eax
mov ecx, dword [ebp - 0x165c]
mov dword [ebp - 0x1660], ecx
mov byte [ebp - 4], 0x11
lea edx, [ebp - 0x12ac]
push edx
mov eax, dword [ebp - 0x1660]
push eax
lea ecx, [ebp - 0x1324]
push ecx
call fcn.0040f270
add esp, 0xc
mov dword [ebp - 0x1664], eax
mov edx, dword [ebp - 0x1664]
mov dword [ebp - 0x14d8], edx
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x14d8]
mov ecx, dword [eax]
mov dword [ebp - 0x14dc], ecx
mov edx, dword [ebp - 0x14dc]
push edx
call fcn.0042fb40
add esp, 4
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1324]
call fcn.004129d0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1320]
call fcn.004129d0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xaac]
call fcn.004129d0
cmp dword [ebp - 0xa88], 0
jne 0x40bb86
mov ecx, dword [ebp - 0x15f8]
call fcn.0040a020
mov ecx, dword [ebp - 0x15f8]
call fcn.00409f40
push 1
mov ecx, dword [ebp - 0x15f8]
call fcn.0040d6a0
lea eax, [ebp - 0x1328]
push eax
mov ecx, 0x506c08
call fcn.00432f50
mov dword [ebp - 0x1668], eax
mov ecx, dword [ebp - 0x1668]
mov dword [ebp - 0x166c], ecx
mov byte [ebp - 4], 0x13
push str.ClientPackageInfo.ini
mov edx, dword [ebp - 0x166c]
push edx
lea eax, [ebp - 0xa74]
push eax
call fcn.0040f270
add esp, 0xc
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1328]
call fcn.004129d0
xor ecx, ecx
mov word [ebp - 0x43c], cx
push 0x206
push 0
lea edx, [ebp - 0x43a]
push edx
call fcn.004931a0
add esp, 0xc
mov eax, dword [ebp - 0xa74]
push eax
push 0x104
lea ecx, [ebp - 0x43c]
push ecx
push 0x4d1180
push str.Client
push str.Version
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [ebp - 0x43c]
push edx
lea ecx, [ebp - 0x230]
call fcn.00412290
mov byte [ebp - 4], 0x16
push 0x20
lea ecx, [ebp - 0x230]
call fcn.0040ed00
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x1528], ecx
cmp dword [ebp - 0x1528], 3
jle 0x40bcc1
push 3
lea edx, [ebp - 0x1330]
push edx
lea ecx, [ebp - 0x230]
call fcn.0040f040
mov dword [ebp - 0x1670], eax
mov eax, dword [ebp - 0x133c]
or eax, 1
mov dword [ebp - 0x133c], eax
push 0x4d4684
mov ecx, dword [ebp - 0x1670]
push ecx
call fcn.0040f430
add esp, 8
movzx edx, al
test edx, edx
je 0x40bcc1
mov dword [ebp - 0x1674], 1
jmp 0x40bccb
mov dword [ebp - 0x1674], 0
mov al, byte [ebp - 0x1674]
mov byte [ebp - 0x1329], al
mov ecx, dword [ebp - 0x133c]
and ecx, 1
je 0x40bcf4
and dword [ebp - 0x133c], 0xfffffffe
lea ecx, [ebp - 0x1330]
call fcn.004129d0
movzx edx, byte [ebp - 0x1329]
test edx, edx
je 0x40bd13
mov ecx, 0x506c08
call fcn.0043e2a0
mov ecx, 0x506c08
call fcn.0043df60
xor eax, eax
mov word [ebp - 0x644], ax
push 0x206
push 0
lea ecx, [ebp - 0x642]
push ecx
call fcn.004931a0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x644]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x644]
push eax
lea ecx, [ebp - 0x228]
call fcn.00412290
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x644]
push ecx
lea ecx, [ebp - 0xa80]
call fcn.00412290
mov byte [ebp - 4], 0x18
lea edx, [ebp - 0x644]
push edx
lea ecx, [ebp - 0xa8c]
call fcn.00412290
mov byte [ebp - 4], 0x19
mov eax, str.DynamicDll.dll
test eax, eax
jne 0x40bd9b
mov dword [ebp - 0x1584], 0
jmp 0x40bdae
push str.DynamicDll.dll
call fcn.004939fc
add esp, 4
mov dword [ebp - 0x1584], eax
mov ecx, dword [ebp - 0x1584]
push ecx
push str.DynamicDll.dll
lea ecx, [ebp - 0x228]
call fcn.00411880
mov edx, str.DynamicDll64.dll
test edx, edx
jne 0x40bdda
mov dword [ebp - 0x1588], 0
jmp 0x40bded
push str.DynamicDll64.dll
call fcn.004939fc
add esp, 4
mov dword [ebp - 0x1588], eax
mov eax, dword [ebp - 0x1588]
push eax
push str.DynamicDll64.dll
lea ecx, [ebp - 0xa80]
call fcn.00411880
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x158c], ecx
mov edx, dword [ebp - 0x158c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0xa70], eax
cmp dword [ebp - 0xa70], 0
jne 0x40be3d
push 4
push 0
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ecx, dword [ebp - 0xa80]
mov dword [ebp - 0x1590], ecx
mov edx, dword [ebp - 0x1590]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0xa70], eax
cmp dword [ebp - 0xa70], 0
jne 0x40be76
push 4
push 0
mov eax, dword [ebp - 0xa80]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor ecx, ecx
mov word [ebp - 0x224], cx
push 0x206
push 0
lea edx, [ebp - 0x222]
push edx
call fcn.004931a0
add esp, 0xc
lea ecx, [ebp - 0xa7c]
call fcn.00412230
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x850]
call fcn.00412230
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xa6c]
call fcn.00412230
mov byte [ebp - 4], 0x1c
push 0
call fcn.0043cd80
add esp, 4
push 0x208
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x104
lea ecx, [ebp - 0xa64]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
push 1
call fcn.0043cd80
add esp, 4
mov ecx, dword [ebp - 0x15f8]
call fcn.004091f0
push 2
mov ecx, dword [ebp - 0x15f8]
call fcn.0040d630
mov ecx, dword [ebp - 0x15f8]
call fcn.004066c0
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xa6c]
call fcn.004129d0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x850]
call fcn.004129d0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xa7c]
call fcn.004129d0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xa8c]
call fcn.004129d0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xa80]
call fcn.004129d0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x228]
call fcn.004129d0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x230]
call fcn.004129d0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa74]
call fcn.004129d0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa84]
call fcn.004129d0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x858]
call fcn.004129d0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x22c]
call fcn.004129d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x854]
call fcn.004129d0
xor edx, edx
jne 0x40ad92
mov ecx, dword [ebp - 0x15f8]
call fcn.00403270
test eax, eax
je 0x40c001
push str._Update_:_DoUpdate_Installing_ProcessCtrl_is_done.
call fcn.0042fb40
add esp, 4
jmp 0x40c00e
push str._Update_:_DoUpdate_Installing_ProcessCtrl_is_failed.
call fcn.0042fb40
add esp, 4
lea eax, [ebp - 0x1334]
push eax
mov ecx, 0x506c08
call fcn.00432f50
mov dword [ebp - 0x1678], eax
mov ecx, dword [ebp - 0x1678]
mov dword [ebp - 0x167c], ecx
mov dword [ebp - 4], 0x1d
push str.UpdatePatch.ini
mov edx, dword [ebp - 0x167c]
push edx
lea eax, [ebp - 0x1338]
push eax
call fcn.0040f270
add esp, 0xc
mov dword [ebp - 0x15e8], eax
mov ecx, dword [ebp - 0x15e8]
mov edx, dword [ecx]
mov dword [ebp - 0x15ec], edx
mov eax, dword [ebp - 0x15ec]
push eax
push 0
push str.DeleteProcessCtrl
push 0x4d450c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x1338]
call fcn.004129d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1334]
call fcn.004129d0
cmp dword [ebp - 0x10], 0
je 0x40c0b1
mov ecx, dword [ebp - 0x15f8]
call fcn.004031d0
mov ecx, dword [ebp - 0x15f8]
call fcn.004091f0
mov ecx, dword [ebp - 0x15f8]
call fcn.004023f0
test eax, eax
jne 0x40c0d8
push str.DoUpdate_Call_StartFileLockProtect_Fail_
call fcn.0042fb40
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
push str.DoUpdate__d_
call fcn.0042fb40
add esp, 8
mov eax, dword [ebp - 0x14]
lea esp, [ebp - 0x1680]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0049318c
mov esp, ebp
pop ebp
ret 0x10