Function at 0x42fec0
Capabilities:
Check if file exists
Check os version
Compare security identifiers
Create process on windows
Delete directory
Delete file
Enumerate gui resources
Enumerate processes
Get common file path
Move file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d80f2
mov eax, dword fs:[0]
push eax
sub esp, 0xc20
mov eax, dword [0x536f50]
xor eax, esp
mov dword [esp + 0xc18], eax
push ebx
push esi
push edi
mov eax, dword [0x536f50]
xor eax, esp
push eax
lea eax, [esp + 0xc30]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x6c], ecx
cmp dword [ecx + 0x10c], edi
je 0x42ffab
mov eax, dword [0x53ac30]
mov edx, dword [eax + 0xc]
mov ecx, 0x53ac30
call edx
add eax, 0x10
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 0x1b6c
mov dword [esp + 0xc40], edi
call fcn.0041eee0
add esp, 8
test eax, eax
jne 0x42ff6a
push edi
push 0x1b6c
call fcn.00401280
add esp, 8
cmp eax, edi
je 0x42ff6a
push 0x1b6c
push eax
lea ecx, [esp + 0x20]
call fcn.00402d60
mov esi, dword [esp + 0x18]
push 5
push edi
push edi
push esi
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esi - 0x10]
mov dword [esp + 0xc38], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4313a5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4313a5
lea ecx, [esp + 0xa1c]
push 0x104
push ecx
call fcn.0043e3b0
sub esp, 0x14
mov ecx, esp
mov ebx, 7
xor edx, edx
lea eax, [esp + 0xa38]
mov dword [ecx + 0x18], ebx
mov dword [ecx + 0x14], edi
mov dword [esp + 0x14c], esp
mov word [ecx + 4], dx
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, di
jne 0x42ffe4
sub eax, esi
sar eax, 1
push eax
lea eax, [esp + 0xa3c]
push eax
call fcn.00402500
lea ecx, [esp + 0x18c]
push ecx
call fcn.0042da90
add esp, 0x20
mov eax, dword [esp + 0x174]
mov esi, 8
mov dword [esp + 0xc38], 1
cmp dword [esp + 0x188], esi
jae 0x430038
lea eax, [esp + 0x174]
push eax
call fcn.0042e3d0
add esp, 4
call fcn.00429930
call fcn.0042e4c0
lea edx, [esp + 0xa1c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push str.kuaizipUpdateChecker.dll
lea eax, [esp + 0x174]
push eax
lea ecx, [esp + 0x7c]
push ecx
call fcn.0041b480
push 0x208
lea eax, [esp + 0x81e]
xor edx, edx
push edi
push eax
mov byte [esp + 0xc50], 2
mov word [esp + 0x824], dx
call fcn.0047a920
add esp, 0x18
push 0x104
lea ecx, [esp + 0x810]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor edx, edx
lea eax, [esp + 0x80c]
mov word [esp + 0x13c], dx
mov dword [esp + 0x150], ebx
mov dword [esp + 0x14c], edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4300d0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x810]
push eax
lea ecx, [esp + 0x140]
call fcn.00402500
push 0xd
push 0x4dfd2c
lea ecx, [esp + 0x140]
mov byte [esp + 0xc40], 3
call fcn.0040fbe0
mov eax, dword [esp + 0x78]
cmp dword [esp + 0x8c], esi
jae 0x430120
lea eax, [esp + 0x78]
push 0x4dfd28
push eax
call fcn.0047ab84
add esp, 8
test eax, eax
je 0x430273
xor ecx, ecx
push 1
mov word [esp + 0x9c], cx
push 0x4dfd24
lea ecx, [esp + 0x9c]
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb0], edi
call fcn.00402500
push 1
xor edx, edx
push 0x4dfd24
lea ecx, [esp + 0x38]
mov byte [esp + 0xc40], 4
mov dword [esp + 0x50], ebx
mov dword [esp + 0x4c], edi
mov word [esp + 0x3c], dx
call fcn.00402500
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x58]
push edx
mov byte [esp + 0xc44], 5
call fcn.004107a0
lea ecx, [esp + 0xa0]
push ecx
push eax
lea edx, [esp + 0xc4]
push edx
mov byte [esp + 0xc50], 6
call fcn.004107a0
add esp, 0x18
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xc44], 7
call fcn.00401da0
cmp dword [esp + 0xc8], esi
jb 0x4301f6
mov eax, dword [esp + 0xb4]
push eax
call fcn.004798f2
add esp, 4
xor ecx, ecx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xc4], edi
mov word [esp + 0xb4], cx
cmp dword [esp + 0x68], esi
jb 0x430221
mov edx, dword [esp + 0x54]
push edx
call fcn.004798f2
add esp, 4
xor eax, eax
mov dword [esp + 0x68], ebx
mov dword [esp + 0x64], edi
mov word [esp + 0x54], ax
cmp dword [esp + 0x48], esi
jb 0x430243
mov ecx, dword [esp + 0x34]
push ecx
call fcn.004798f2
add esp, 4
xor edx, edx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], edi
mov word [esp + 0x34], dx
mov byte [esp + 0xc38], 3
cmp dword [esp + 0xac], esi
jb 0x430273
mov eax, dword [esp + 0x98]
push eax
call fcn.004798f2
add esp, 4
push 5
push 0x4dfd18
lea ecx, [esp + 0x140]
call fcn.0040fbe0
push 5
push 0x4dfd0c
lea ecx, [esp + 0x140]
call fcn.0040fbe0
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x7c]
push ecx
lea ecx, [esp + 0x144]
call fcn.00410670
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
sub esp, 0x1c
mov edx, esp
mov dword [esp + 0x14c], esp
push eax
push edx
call fcn.0042db20
lea eax, [esp + 0x74]
add esp, 8
push eax
call fcn.0042cb40
add esp, 0x20
mov ecx, dword [eax + 0x14]
push 6
push 0x4ded34
push ecx
push edi
mov ecx, eax
mov byte [esp + 0xc48], 8
call fcn.00410570
test eax, eax
mov esi, 8
sete bl
mov byte [esp + 0xc38], 3
cmp dword [esp + 0x68], esi
jb 0x430316
mov edx, dword [esp + 0x54]
push edx
call fcn.004798f2
add esp, 4
test bl, bl
je 0x430c33
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x14c], esp
push 0xffffffffffffffff
push edi
lea edx, [esp + 0x15c]
xor eax, eax
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], edi
push edx
mov word [ecx + 4], ax
call fcn.00401da0
lea eax, [esp + 0x6c]
push eax
call fcn.0041b8b0
add esp, 0x20
cmp dword [eax + 0x18], 0x10
mov byte [esp + 0xc38], 9
jb 0x43036e
mov esi, dword [eax + 4]
mov dword [esp + 0x28], esi
jmp 0x430377
add eax, 4
mov dword [esp + 0x28], eax
mov esi, eax
cmp esi, edi
je 0x430c16
push 0x103
lea ecx, [esp + 0x709]
push edi
push ecx
mov byte [esp + 0x710], 0
call fcn.0047a920
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4303a2
sub eax, edx
cmp eax, 2
jbe 0x4303ce
cmp byte [esi + 1], 0x3a
jne 0x4303ce
push esi
lea edx, [esp + 0x708]
push 0x104
push edx
call fcn.0047d212
add esp, 0xc
jmp 0x4303ff
push 0x104
lea eax, [esp + 0x708]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x704]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push esi
lea edx, [esp + 0x708]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push pe_nt_image_headers32
lea eax, [esp + 0x4dc]
push 0
push eax
call fcn.0047a920
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 0x4d4]
mov edi, 0x114
push ecx
mov dword [esp + 0x4d8], edi
xor esi, esi
call ebx
test eax, eax
je 0x430447
cmp dword [esp + 0x4d8], 6
jne 0x430447
mov esi, 1
xor eax, eax
mov dword [esp + 0x14], eax
cmp esi, eax
jne 0x4306ca
push pe_nt_image_headers32
xor esi, esi
lea edx, [esp + 0x194]
push esi
push edx
call fcn.0047a920
add esp, 0xc
lea eax, [esp + 0x18c]
push eax
mov dword [esp + 0x190], edi
call ebx
test eax, eax
je 0x430499
cmp dword [esp + 0x190], 5
jne 0x430499
cmp dword [esp + 0x194], esi
je 0x4305e9
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x1c]
push edx
push 1
push esi
push esi
xor edi, edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x38], esi
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
cmp eax, esi
je 0x4304f4
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x18]
xor eax, eax
mov esi, 0x490
test edx, edx
jbe 0x4304e6
lea ecx, [ebx + 8]
cmp dword [ecx], edi
je 0x4304de
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x4304d0
jmp 0x4304e6
lea eax, [eax + eax*2]
mov edi, dword [ebx + eax*4]
xor esi, esi
push ebx
call sub.WTSAPI32.dll_WTSFreeMemory
test esi, esi
je 0x4304f4
mov eax, esi
jmp 0x430525
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43051f
lea ecx, [esp + 0x14]
push ecx
push edi
call eax
test eax, eax
jne 0x430896
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x430896
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x430888
push 0x228
xor edi, edi
lea edx, [esp + 0x2ac]
push edi
push edx
mov ebx, 0x490
call fcn.0047a920
add esp, 0xc
lea eax, [esp + 0x2a4]
push eax
push esi
mov dword [esp + 0x2ac], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4305b8
jmp 0x430580
lea ecx, [esp + 0x2c8]
push str.explorer.exe
push ecx
call fcn.0047b50a
add esp, 8
test eax, eax
je 0x4305ad
lea edx, [esp + 0x2a4]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x430580
jmp 0x4305c0
mov edi, dword [esp + 0x2ac]
xor ebx, ebx
jmp 0x4305c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x430888
lea eax, [esp + 0x14]
push eax
jmp 0x4306a4
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x430888
push 0x228
xor edi, edi
lea ecx, [esp + 0x2ac]
push edi
push ecx
mov ebx, 0x490
call fcn.0047a920
add esp, 0xc
lea edx, [esp + 0x2a4]
push edx
push esi
mov dword [esp + 0x2ac], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x430678
jmp 0x430640
lea eax, [esp + 0x2c8]
push str.explorer.exe
push eax
call fcn.0047b50a
add esp, 8
test eax, eax
je 0x43066d
lea ecx, [esp + 0x2a4]
push ecx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x430640
jmp 0x430680
mov edi, dword [esp + 0x2ac]
xor ebx, ebx
jmp 0x430680
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x430888
lea edx, [esp + 0x14]
push edx
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4306bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x43088e
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
push ecx
xor esi, esi
push 1
push esi
push esi
mov dword [esp + 0x24], esi
xor edi, edi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x38], esi
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
cmp eax, esi
je 0x43072d
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x18]
xor eax, eax
mov esi, 0x490
test edx, edx
jbe 0x43071d
lea ecx, [ebx + 8]
cmp dword [ecx], edi
je 0x430715
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x430707
jmp 0x43071d
lea edx, [eax + eax*2]
mov edi, dword [ebx + edx*4]
xor esi, esi
push ebx
call sub.WTSAPI32.dll_WTSFreeMemory
test esi, esi
je 0x43072b
mov eax, esi
jmp 0x43075e
xor esi, esi
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x430758
lea ecx, [esp + 0x10]
push ecx
push edi
call eax
cmp eax, esi
jne 0x430851
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x430851
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x430781
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x430849
push 0x228
xor edi, edi
lea edx, [esp + 0x2ac]
push edi
push edx
mov ebx, 0x490
call fcn.0047a920
add esp, 0xc
lea eax, [esp + 0x2a4]
push eax
push esi
mov dword [esp + 0x2ac], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4307f8
jmp 0x4307c0
lea ecx, [esp + 0x2c8]
push str.explorer.exe
push ecx
call fcn.0047b50a
add esp, 8
test eax, eax
je 0x4307ed
lea edx, [esp + 0x2a4]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4307c0
jmp 0x430800
mov edi, dword [esp + 0x2ac]
xor ebx, ebx
jmp 0x430800
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x430823
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x430849
lea eax, [esp + 0x10]
push eax
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x430840
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
test eax, eax
jne 0x430c05
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
push 4
lea edx, [esp + 0x138]
push edx
push 0x13
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x43087b
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
jmp 0x430896
mov edx, dword [esp + 0x130]
mov dword [esp + 0x14], edx
jmp 0x430896
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x430c05
push 0x40
xor esi, esi
lea eax, [esp + 0xec]
push esi
push eax
mov dword [esp + 0xf0], 0x44
call fcn.0047a920
add esp, 0xc
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push esi
push esi
push esi
push esi
push esi
push esi
xor eax, eax
push 0x220
push 0x20
push 2
lea edx, [esp + 0x158]
push edx
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov byte [esp + 0x4b], al
mov dword [esp + 0x3c], esi
mov byte [esp + 0x15c], al
mov byte [esp + 0x15d], al
mov byte [esp + 0x15e], al
mov byte [esp + 0x15f], al
mov byte [esp + 0x160], al
mov byte [esp + 0x161], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x4309a2
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [esp + 0x20]
push eax
push esi
push esi
push 2
push edi
call ebx
test eax, eax
jne 0x43094a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4309a2
mov ecx, dword [esp + 0x20]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x20]
push edx
push eax
push esi
push 2
push edi
call ebx
test eax, eax
je 0x430997
xor edi, edi
cmp dword [esi], edi
jbe 0x430997
lea ebx, [esi + 4]
mov ecx, dword [ebx]
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x430992
inc edi
add ebx, 8
cmp edi, dword [esi]
jb 0x430976
jmp 0x430997
mov byte [esp + 0x1f], 1
test esi, esi
je 0x4309a2
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x10]
xor esi, esi
cmp eax, esi
je 0x4309b3
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp byte [esp + 0x1f], 0
jne 0x430af0
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x134]
push ecx
push 1
push esi
push esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x144], esi
mov dword [esp + 0x40], esi
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
cmp eax, esi
jne 0x430a3a
push pe_nt_image_headers32
lea edx, [esp + 0x5f4]
push esi
push edx
call fcn.0047a920
add esp, 0xc
lea eax, [esp + 0x5ec]
push eax
mov dword [esp + 0x5f0], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x430a34
cmp dword [esp + 0x5f0], 6
jne 0x430a34
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x430a78
mov dword [esp + 0x24], esi
jmp 0x430a80
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x130]
xor eax, eax
mov esi, 0x490
test edx, edx
jbe 0x430a6e
lea ecx, [edi + 8]
cmp dword [ecx], 0
je 0x430a62
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x430a53
jmp 0x430a6e
lea ecx, [eax + eax*2]
mov edx, dword [edi + ecx*4]
mov dword [esp + 0x24], edx
xor esi, esi
push edi
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, esi
xor esi, esi
cmp eax, esi
jne 0x430af0
lea eax, [esp + 0x10]
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x430af0
lea ecx, [esp + 0x20]
push ecx
push 1
push 1
push esi
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
cmp dword [esp + 0x20], esi
jne 0x430ac5
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x430af0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x20]
push 4
lea ecx, [esp + 0x28]
push ecx
push 0xc
push edx
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x430af0
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
xor edi, edi
push str.userenv.dll
mov dword [esp + 0xf0], str.Winsta0Default
mov ebx, 0x30
mov dword [esp + 0x1c], edi
mov dword [esp + 0x134], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x430b64
push str.CreateEnvironmentBlock
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DestroyEnvironmentBlock
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x130], eax
test edi, edi
je 0x430b64
mov ecx, dword [esp + 0x14]
push 0
push ecx
lea edx, [esp + 0x20]
push edx
call edi
test eax, eax
je 0x430b5c
mov ebx, 0x430
jmp 0x430b64
mov dword [esp + 0x18], 0
push 0x103
lea eax, [esp + 0x191]
push 0
push eax
mov byte [esp + 0x198], 0
call fcn.0047a920
mov ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0x19c]
push 0x103
push edx
call fcn.0047d212
mov edx, dword [esp + 0x30]
add esp, 0x18
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0xe8]
push ecx
mov ecx, dword [esp + 0x1c]
push 0
push edx
push ebx
push 0
push 0
push 0
lea eax, [esp + 0x1ac]
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov eax, dword [esp + 0x30]
test eax, eax
je 0x430bd9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x34]
test eax, eax
je 0x430be8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x130]
test eax, eax
je 0x430bfa
mov edx, dword [esp + 0x18]
push edx
call eax
test esi, esi
je 0x430c05
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x430c14
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
cmp dword [esp + 0x68], 0x10
jb 0x430cab
mov ecx, dword [esp + 0x54]
push ecx
call fcn.004798f2
add esp, 4
jmp 0x430cab
push 0x44
lea edx, [esp + 0xe8]
push edi
push edx
call fcn.0047a920
mov eax, dword [esp + 0x148]
add esp, 0xc
mov dword [esp + 0xe4], 0x44
cmp dword [esp + 0x150], esi
jae 0x430c68
lea eax, [esp + 0x13c]
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0xe8]
push edx
push edi
push edi
push edi
push edi
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x430cab
mov eax, dword [esp + 0x30]
push 0xdbba0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x34]
push edx
call esi
mov esi, 8
cmp dword [esp + 0x150], esi
jb 0x430cc9
mov eax, dword [esp + 0x13c]
push eax
call fcn.004798f2
add esp, 4
xor ecx, ecx
mov dword [esp + 0x150], 7
mov dword [esp + 0x14c], edi
mov word [esp + 0x13c], cx
mov byte [esp + 0xc38], 1
cmp dword [esp + 0x8c], esi
jb 0x430d03
mov edx, dword [esp + 0x78]
push edx
call fcn.004798f2
add esp, 4
call fcn.0042d540
push edi
push 0x429dd0
call dword [sym.imp.USER32.dll_EnumWindows]
call fcn.0042cf20
lea ecx, [esp + 0xcc]
call fcn.00422ae0
lea eax, [esp + 0xcc]
push eax
mov byte [esp + 0xc3c], 0xa
call fcn.0042f610
add esp, 4
call fcn.0041ded0
call fcn.0041aff0
call fcn.0043b510
push edi
push edi
push 0x2000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xc8
call esi
mov ebx, dword [esp + 0x6c]
mov ecx, dword [ebx + 4]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edx, dword [0x53ac30]
mov eax, dword [edx + 0xc]
mov ecx, 0x53ac30
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov byte [esp + 0xc38], 0xb
cmp dword [ebx + 0x40], edi
jne 0x430dcb
lea ecx, [esp + 0x28]
push ecx
push 0x1b72
call fcn.0041eee0
add esp, 8
push 5
push edi
push edi
test eax, eax
je 0x430dbe
mov edx, dword [esp + 0x34]
push edx
jmp 0x430dc3
push str.http:__www.kpzip.com_unist.php
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x64
call esi
push edi
push str._f__im__KZMount2.exe
push str.taskkill.exe
push edi
call fcn.004d3c50
push edi
push str._f__im__KuaiZip.exe
push str.taskkill.exe
push edi
call fcn.004d3c50
push edi
push str._f__im__Update.exe
push str.taskkill.exe
push edi
call fcn.004d3c50
push edi
push str._f__im__KZReport.exe
push str.taskkill.exe
push edi
call fcn.004d3c50
add esp, 0x40
call fcn.0042e690
call fcn.00429f20
call fcn.0042a040
push 0x4e0524
call fcn.0042ee90
push 0x4e0510
call fcn.0042ee90
push 0x4fbc8f
push str.app_uninstall_done
call fcn.0041ce80
mov eax, dword [0x53ac30]
mov edx, dword [eax + 0xc]
add esp, 0x10
mov ecx, 0x53ac30
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 0x1b74
mov byte [esp + 0xc40], 0xc
call fcn.0041eee0
add esp, 8
test eax, eax
jne 0x430e98
lea ecx, [esp + 0x10]
call fcn.00402fb0
push 0x10
push 0x4e04d8
lea ecx, [esp + 0x18]
call fcn.0042b120
mov edx, dword [0x53ac30]
mov eax, dword [edx + 0xc]
mov ecx, 0x53ac30
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x14]
push ecx
push 0x1b60
mov byte [esp + 0xc40], 0xd
call fcn.0041eee0
add esp, 8
test eax, eax
jne 0x430ee6
lea ecx, [esp + 0x14]
call fcn.00402fb0
push 4
push 0x4e04cc
lea ecx, [esp + 0x1c]
call fcn.0042b120
mov esi, dword [esp + 0x14]
mov edi, 1
cmp dword [esi - 4], edi
jle 0x430f05
mov edx, dword [esi - 0xc]
push edx
lea ecx, [esp + 0x18]
call fcn.004031c0
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp dword [eax - 4], edi
jle 0x430f1f
mov eax, dword [eax - 0xc]
push eax
lea ecx, [esp + 0x14]
call fcn.004031c0
mov eax, dword [esp + 0x10]
push 0x40
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
call fcn.00429c50
mov ecx, dword [0x53a8c4]
mov edi, dword [ecx]
mov esi, dword [0x53a8b0]
mov edi, edi
mov ebx, dword [0x53a8c4]
test esi, esi
je 0x430f52
cmp esi, dword [0x53a8b0]
je 0x430f57
call fcn.0047b9cb
cmp edi, ebx
je 0x430fc4
test esi, esi
jne 0x430fb8
call fcn.0047b9cb
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x430f70
call fcn.0047b9cb
mov eax, dword [edi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x430f9f
test esi, esi
jne 0x430fbc
call fcn.0047b9cb
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x430f93
call fcn.0047b9cb
mov edx, dword [edi + 8]
push edx
call fcn.00429b00
add esp, 4
test esi, esi
jne 0x430fc0
call fcn.0047b9cb
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x430fb4
call fcn.0047b9cb
mov edi, dword [edi]
jmp 0x430f40
mov eax, dword [esi]
jmp 0x430f66
mov eax, dword [esi]
jmp 0x430f89
mov eax, dword [esi]
jmp 0x430faa
mov dword [esp + 0x130], 0
nop
mov eax, dword [0x53a8e0]
mov esi, dword [eax]
mov edi, dword [0x53a8cc]
lea ecx, [ecx]
mov ebx, dword [0x53a8e0]
test edi, edi
je 0x430ff2
cmp edi, dword [0x53a8cc]
je 0x430ff7
call fcn.0047b9cb
cmp esi, ebx
je 0x431085
test edi, edi
jne 0x43105e
call fcn.0047b9cb
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x431014
call fcn.0047b9cb
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43106a
test edi, edi
jne 0x431062
call fcn.0047b9cb
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x431037
call fcn.0047b9cb
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x43106a
test edi, edi
jne 0x431066
call fcn.0047b9cb
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x43105a
call fcn.0047b9cb
mov esi, dword [esi]
jmp 0x430fe0
mov eax, dword [edi]
jmp 0x43100a
mov eax, dword [edi]
jmp 0x43102d
mov eax, dword [edi]
jmp 0x431050
push esi
push edi
lea ecx, [esp + 0x74]
push ecx
mov ecx, 0x53a8cc
call fcn.0042d8b0
mov edi, dword [eax]
mov esi, dword [eax + 4]
jmp 0x430fe0
mov ecx, dword [0x53a8e4]
test ecx, ecx
je 0x431185
mov eax, dword [esp + 0x130]
inc eax
cmp eax, 0x63
mov dword [esp + 0x130], eax
jl 0x430fd0
test ecx, ecx
jbe 0x431185
mov edx, dword [0x53a8e0]
mov ebx, dword [edx]
mov esi, dword [0x53a8cc]
mov edi, dword [0x53a8e0]
test esi, esi
je 0x4310d3
cmp esi, dword [0x53a8cc]
je 0x4310d8
call fcn.0047b9cb
cmp ebx, edi
je 0x431185
test esi, esi
jne 0x431172
call fcn.0047b9cb
xor eax, eax
cmp ebx, dword [eax + 0x14]
jne 0x4310f9
call fcn.0047b9cb
mov eax, dword [ebx + 8]
lea edi, [ebx + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x431156
test esi, esi
jne 0x431179
call fcn.0047b9cb
xor eax, eax
cmp ebx, dword [eax + 0x14]
jne 0x43111f
call fcn.0047b9cb
lea eax, [esp + 0xcc]
push eax
push edi
call fcn.0042ebb0
add esp, 8
test eax, eax
jne 0x431156
test esi, esi
jne 0x43117d
call fcn.0047b9cb
xor eax, eax
cmp ebx, dword [eax + 0x14]
jne 0x431149
call fcn.0047b9cb
mov ecx, dword [edi]
push 4
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test esi, esi
jne 0x431181
call fcn.0047b9cb
xor eax, eax
cmp ebx, dword [eax + 0x14]
jne 0x43116b
call fcn.0047b9cb
mov ebx, dword [ebx]
jmp 0x4310c1
mov eax, dword [esi]
jmp 0x4310ef
mov eax, dword [esi]
jmp 0x431115
mov eax, dword [esi]
jmp 0x43113f
mov eax, dword [esi]
jmp 0x431161
lea edx, [esp + 0x50]
push edx
call fcn.004d6500
add esp, 4
mov esi, 0x10
mov byte [esp + 0xc38], 0xe
cmp dword [eax + 0x18], esi
jb 0x4311a9
mov eax, dword [eax + 4]
jmp 0x4311ac
add eax, 4
push eax
lea eax, [esp + 0x158]
push eax
call fcn.004d3840
add esp, 8
mov byte [esp + 0xc38], 0x10
cmp dword [esp + 0x68], esi
jb 0x4311d8
mov ecx, dword [esp + 0x54]
push ecx
call fcn.004798f2
add esp, 4
mov eax, dword [esp + 0x158]
xor edi, edi
mov ebx, 8
mov dword [esp + 0x68], 0xf
mov dword [esp + 0x64], edi
mov byte [esp + 0x54], 0
cmp dword [esp + 0x16c], ebx
jae 0x431207
lea eax, [esp + 0x158]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x431266
mov eax, dword [esp + 0x158]
cmp dword [esp + 0x16c], ebx
jae 0x431229
lea eax, [esp + 0x158]
push eax
lea ecx, [esp + 0x134]
call fcn.00401870
lea edx, [esp + 0xcc]
push edx
lea eax, [esp + 0x134]
push eax
mov byte [esp + 0xc40], 0x11
mov dword [esp + 0x54], 1
call fcn.0042ebb0
add esp, 8
test eax, eax
jne 0x431266
mov bl, 1
jmp 0x431268
xor bl, bl
test byte [esp + 0x4c], 1
mov dword [esp + 0xc38], esi
je 0x431299
mov eax, dword [esp + 0x130]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x431299
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, 8
test bl, bl
je 0x4312c3
mov eax, dword [esp + 0x158]
cmp dword [esp + 0x16c], esi
jae 0x4312b9
lea eax, [esp + 0x158]
push 4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 1
call dword [sym.imp.USER32.dll_PostQuitMessage]
cmp dword [esp + 0x16c], esi
jb 0x4312e4
mov ecx, dword [esp + 0x158]
push ecx
call fcn.004798f2
add esp, 4
mov eax, dword [esp + 0x14]
xor edx, edx
add eax, 0xfffffff0
mov word [esp + 0x158], dx
mov dword [esp + 0x16c], 7
mov dword [esp + 0x168], edi
mov byte [esp + 0xc38], 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x431328
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0xc38], 0xb
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x431350
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0xc38], 0xa
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x431378
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xcc]
mov byte [esp + 0xc38], 1
call fcn.0042f180
cmp dword [esp + 0x188], esi
jb 0x4313a5
mov ecx, dword [esp + 0x174]
push ecx
call fcn.004798f2
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0xc30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xc18]
xor ecx, esp
call fcn.0047a885
mov esp, ebp
pop ebp
ret 0x10