Function at 0x404940
Capabilities:
Create process on windows
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x544f8d
mov eax, dword fs:[0]
push eax
mov eax, 0x16f4
call fcn.0052e580
mov eax, dword [0x5a8040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1684], ebx
call fcn.00405470
push 0x7d0
lea eax, [ebp - 0x13c0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp byte [ebx + 0x200b], 0
je 0x404c40
xor eax, eax
mov dword [ebp - 0x13f4], 7
mov dword [ebp - 0x13f8], 0
mov word [ebp - 0x1408], ax
cmp word [ebp - 0x13c0], ax
jne 0x4049ca
xor ecx, ecx
jmp 0x4049e2
lea ecx, [ebp - 0x13c0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4049d3
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x13c0]
push eax
lea ecx, [ebp - 0x1408]
call fcn.00405e40
push 1
sub esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1408]
call fcn.00405c00
push eax
push 0
lea eax, [ebp - 0x1420]
push eax
lea ecx, [ebp - 0x1408]
call fcn.00405a80
mov esi, eax
lea eax, [ebp - 0x1408]
cmp eax, esi
je 0x404a6d
cmp dword [ebp - 0x13f4], 8
jb 0x404a44
push dword [ebp - 0x1408]
call fcn.0040b23d
add esp, 4
xor eax, eax
mov dword [ebp - 0x13f4], 7
push esi
lea ecx, [ebp - 0x1408]
mov dword [ebp - 0x13f8], 0
mov word [ebp - 0x1408], ax
call fcn.00405ac0
cmp dword [ebp - 0x140c], 8
jb 0x404a84
push dword [ebp - 0x1420]
call fcn.0040b23d
add esp, 4
push 0x14
push str.InstallerConfig.ini
lea ecx, [ebp - 0x1408]
call fcn.00405b20
cmp dword [ebp - 0x13f4], 8
lea eax, [ebp - 0x1408]
lea ecx, [ebp - 0x1680]
cmovae eax, dword [ebp - 0x1408]
push eax
call fcn.00402690
mov byte [ebp - 4], 1
call fcn.0040e6bf
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x404ad6
push 0x80004005
call fcn.00402a30
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x167c], eax
mov byte [ebp - 4], 2
call fcn.0040e6bf
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x404b06
push 0x80004005
call fcn.00402a30
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1678], eax
mov byte [ebp - 4], 3
call fcn.0040e6bf
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x404b36
push 0x80004005
call fcn.00402a30
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1674], eax
push 7
push str.Install
lea ecx, [ebp - 0x167c]
mov byte [ebp - 4], 4
call fcn.00402590
push 4
push str.BNDL
lea ecx, [ebp - 0x1678]
call fcn.00402590
push 1
push 0x588ed0
lea ecx, [ebp - 0x1674]
call fcn.00402590
push dword [ebp - 0x1680]
mov esi, dword [ebp - 0x1674]
mov edi, dword [ebp - 0x1678]
mov ebx, dword [ebp - 0x167c]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea edx, [esi - 0x10]
mov byte [ebp - 4], 3
or esi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x404bc1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 2
mov ecx, esi
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x404bde
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov byte [ebp - 4], 1
mov ecx, esi
lea eax, [ebx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x404bfb
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1680]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x404c1c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x13f4], 8
jb 0x404c3a
push dword [ebp - 0x1408]
call fcn.0040b23d
add esp, 4
mov ebx, dword [ebp - 0x1684]
xor eax, eax
mov dword [ebp - 0x13dc], 7
mov dword [ebp - 0x13e0], 0
mov word [ebp - 0x13f0], ax
cmp word [ebp - 0x13c0], ax
jne 0x404c6a
xor ecx, ecx
jmp 0x404c82
lea ecx, [ebp - 0x13c0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404c73
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x13c0]
push eax
lea ecx, [ebp - 0x13f0]
call fcn.00405e40
push 1
sub esp, 8
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x13f0]
call fcn.00405c00
push eax
push 0
lea eax, [ebp - 0x1420]
push eax
lea ecx, [ebp - 0x13f0]
call fcn.00405a80
mov esi, eax
lea eax, [ebp - 0x13f0]
cmp eax, esi
je 0x404d0d
cmp dword [ebp - 0x13dc], 8
jb 0x404ce4
push dword [ebp - 0x13f0]
call fcn.0040b23d
add esp, 4
xor eax, eax
mov dword [ebp - 0x13dc], 7
push esi
lea ecx, [ebp - 0x13f0]
mov dword [ebp - 0x13e0], 0
mov word [ebp - 0x13f0], ax
call fcn.00405ac0
cmp dword [ebp - 0x140c], 8
jb 0x404d24
push dword [ebp - 0x1420]
call fcn.0040b23d
add esp, 4
push 0x1a
push 0x588ed4
lea ecx, [ebp - 0x13f0]
call fcn.00405b20
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea eax, [ebp - 0x1674]
push eax
push str.SoftwareMicrosoftInternet_ExplorerMAINFeatureControlFEATURE_BROWSER_EMULATION
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1678], 0x2af8
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x404d97
push 4
lea eax, [ebp - 0x1678]
push eax
push 4
push 0
push str.Install_UI.exe
push dword [ebp - 0x1674]
call esi
push 4
lea eax, [ebp - 0x1678]
push eax
push 4
push 0
push str.HncUpdateTray.exe
push dword [ebp - 0x1674]
call esi
lea eax, [ebp - 0x1674]
mov dword [ebp - 0x1678], 1
push eax
push str.SoftwareMicrosoftInternet_ExplorerMAINFeatureControlFEATURE_96DPI_PIXEL
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x404dec
push 4
lea eax, [ebp - 0x1678]
push eax
push 4
push 0
push str.Install_UI.exe
push dword [ebp - 0x1674]
call esi
push 4
lea eax, [ebp - 0x1678]
push eax
push 4
push 0
push str.HncUpdateTray.exe
push dword [ebp - 0x1674]
call esi
cmp byte [ebx + 0x200a], 1
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jne 0x404ec8
cmp dword [ebp - 0x13dc], 8
lea eax, [ebp - 0x16c0]
push 0x3c
push 0
lea esi, [ebp - 0x13f0]
cmovae esi, dword [ebp - 0x13f0]
push eax
call fcn.0052c790
add esp, 0xc
mov dword [ebp - 0x16c0], 0x3c
cmp dword [ebx + 0xb54], 0
mov dword [ebp - 0x16b4], str.open
mov dword [ebp - 0x16b0], esi
je 0x404e5e
cmp byte [ebx + 0x2216], 0
jne 0x404e5e
mov dword [ebp - 0x16ac], str._prevuninstall
jmp 0x404e92
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__F__T__IM_Hwp.exe
call esi
push 0
push str.taskkill__F__T__IM_HCell.exe
call esi
push 0
push str.taskkill__F__T__IM_HShow.exe
call esi
push 0
push str.taskkill__F__T__IM_Hpdf.exe
call esi
mov dword [ebp - 0x16ac], str._prevuninstall__silent
lea eax, [ebp - 0x16c0]
mov dword [ebp - 0x16a4], 5
push eax
mov dword [ebp - 0x16bc], 0x40
call edi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
push dword [ebp - 0x1688]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebx + 0xb54], 0
je 0x404ede
cmp byte [ebx + 0x2216], 0
je 0x404fc8
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.0052c790
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x420]
add esp, 0xc
push eax
push 1
push 0
push 0x1a
push 0
call esi
push str.HNCUserCommon130_recentInfo.xml
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.0052b0fb
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [ebp - 0x1670]
add esp, 0xc
push eax
lea eax, [ebp - 0x420]
push eax
call edi
cmp eax, 0xffffffff
je 0x404f56
lea eax, [ebp - 0x420]
push eax
call fcn.0052b167
add esp, 4
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.0052c790
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x1a
push 0
call esi
push str.HNCUserCommon130_themeInfo.xml
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.0052b0fb
add esp, 0xc
lea eax, [ebp - 0x1670]
push eax
lea eax, [ebp - 0x218]
push eax
call edi
cmp eax, 0xffffffff
je 0x404fc2
lea eax, [ebp - 0x218]
push eax
call fcn.0052b167
add esp, 4
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0x13dc], 8
lea esi, [ebp - 0x13f0]
lea ecx, [ebp - 0x13d8]
mov dword [ebp - 0x13c4], 7
cmovae esi, dword [ebp - 0x13f0]
xor eax, eax
push eax
push 0x58877c
mov dword [ebp - 0x13c8], 0
mov word [ebp - 0x13d8], ax
call fcn.00405e40
push 0x3c
lea eax, [ebp - 0x16fc]
mov byte [ebp - 4], 6
push 0
push eax
call fcn.0052c790
add esp, 0xc
mov dword [ebp - 0x16fc], 0x3c
lea ecx, [ebp - 0x13d8]
mov dword [ebp - 0x16f0], str.open
mov dword [ebp - 0x16ec], esi
push 8
push 0x5891f8
call fcn.00405b20
cmp dword [ebx + 0xb54], 0
je 0x40505f
cmp byte [ebx + 0x2216], 0
je 0x405071
push 8
push str.__silent
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
cmp byte [ebx + 0x2217], 0
je 0x40508c
push 0xa
push str.__oneclick
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
cmp byte [ebx + 0x2218], 0
je 0x4050a7
push 0xb
push str.__norestart
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
cmp byte [ebx + 0x2219], 0
je 0x4050c2
push 0xf
push str.__promptrestart
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
cmp byte [ebx + 0x221a], 0
je 0x4050dd
push 5
push str.__log
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
cmp byte [ebx + 0x221b], 0
je 0x4050f8
push 0x10
push str.__update_disable
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
cmp byte [ebx + 0x221c], 0
je 0x405113
push 0xd
push str.__psl_disable
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
lea esi, [ebx + 0x221e]
mov ecx, esi
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405120
sub ecx, edx
sar ecx, 1
je 0x40516e
push 1
push 0x5892a4
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
cmp word [esi], 0
jne 0x40514d
xor ecx, ecx
jmp 0x405161
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405152
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
lea esi, [ebx + 0x2426]
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405180
sub ecx, edx
sar ecx, 1
je 0x4051ce
push 1
push 0x5892a4
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
cmp word [esi], 0
jne 0x4051ad
xor ecx, ecx
jmp 0x4051c1
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4051b2
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
lea esi, [ebx + 0x262e]
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4051e0
sub ecx, edx
sar ecx, 1
je 0x40522e
push 1
push 0x5892a4
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
cmp word [esi], 0
jne 0x40520d
xor ecx, ecx
jmp 0x405221
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405212
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
lea esi, [ebx + 0x2836]
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405240
sub ecx, edx
sar ecx, 1
je 0x40528e
push 1
push 0x5892a4
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
cmp word [esi], 0
jne 0x40526d
xor ecx, ecx
jmp 0x405281
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405272
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
lea esi, [ebx + 0x2a3e]
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4052a0
sub ecx, edx
sar ecx, 1
je 0x4052ee
push 1
push 0x5892a4
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
cmp word [esi], 0
jne 0x4052cd
xor ecx, ecx
jmp 0x4052e1
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4052d2
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
lea esi, [ebx + 0x2c46]
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405300
sub ecx, edx
sar ecx, 1
je 0x40534e
push 1
push 0x5892a4
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
cmp word [esi], 0
jne 0x40532d
xor ecx, ecx
jmp 0x405341
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405332
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
add ebx, 0x2e4e
mov ecx, ebx
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405360
sub ecx, edx
sar ecx, 1
je 0x4053ae
push 1
push 0x5892a4
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
cmp word [ebx], 0
jne 0x40538d
xor ecx, ecx
jmp 0x4053a1
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x405392
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x13d8]
call fcn.00405b20
cmp dword [ebp - 0x13c4], 8
lea eax, [ebp - 0x13d8]
mov dword [ebp - 0x16e0], 5
cmovae eax, dword [ebp - 0x13d8]
mov dword [ebp - 0x16e8], eax
lea eax, [ebp - 0x16fc]
push eax
mov dword [ebp - 0x16f8], 0x40
call edi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
push dword [ebp - 0x16c4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x13c4], 8
jb 0x405415
push dword [ebp - 0x13d8]
call fcn.0040b23d
add esp, 4
xor eax, eax
mov dword [ebp - 0x13c4], 7
cmp dword [ebp - 0x13dc], 8
mov dword [ebp - 0x13c8], 0
mov word [ebp - 0x13d8], ax
jb 0x405449
push dword [ebp - 0x13f0]
call fcn.0040b23d
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00529d59
mov esp, ebp
pop ebp
ret