Function at 0x4becf0
Capabilities:
Delete file
Get common file path
Get file size
Get program files directory
Move file
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5ee77f
mov eax, dword fs:[0]
push eax
mov eax, 0x269bc
call fcn.004ea880
mov eax, dword [0x704dd8]
xor eax, esp
mov dword [esp + 0x269b8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x704dd8]
xor eax, esp
push eax
lea eax, [esp + 0x269d0]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x269e0]
mov dword [esp + 0x2c], ebp
call fcn.00409730
mov ecx, eax
call fcn.004a3a20
xor ebx, ebx
xor ecx, ecx
mov word [esp + 0x2bc], cx
mov edi, 7
mov ecx, eax
mov dword [esp + 0x2d0], edi
mov dword [esp + 0x2cc], ebx
lea edx, [ecx + 2]
lea ebx, [ebx]
mov si, word [ecx]
add ecx, 2
cmp si, bx
jne 0x4bed70
sub ecx, edx
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x2c0]
call fcn.00401c70
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x2c0]
xor edx, edx
push eax
lea ecx, [esp + 0x21c]
mov dword [esp + 0x269e4], ebx
mov dword [esp + 0x234], edi
mov dword [esp + 0x230], ebx
mov word [esp + 0x220], dx
call fcn.00401f60
push 0xffffffffffffffff
xor ecx, ecx
push ebx
lea edx, [esp + 0x2c0]
mov word [esp + 0x318], cx
push edx
lea ecx, [esp + 0x318]
mov byte [esp + 0x269e4], 1
mov dword [esp + 0x330], edi
mov dword [esp + 0x32c], ebx
call fcn.00401f60
push 0xb
push str.Slation.exe
lea ecx, [esp + 0x314]
mov byte [esp + 0x269e0], 2
call fcn.00402e80
push 0x206
lea ecx, [esp + 0x267ca]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x267d0], ax
call fcn.004e9ba0
lea edx, [esp + 0x2c4]
push edx
lea eax, [esp + 0x300]
push eax
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
call fcn.004a9000
add esp, 0x14
push 8
push str.Temp.xml
lea ecx, [esp + 0x2f8]
mov byte [esp + 0x269e0], 3
call fcn.0041ca40
lea ecx, [esp + 0x2f0]
push ecx
lea edx, [esp + 0x284]
push edx
call fcn.004a93a0
add esp, 8
cmp dword [esp + 0x298], 8
mov eax, dword [esp + 0x284]
mov byte [esp + 0x269d8], 4
jae 0x4beea5
lea eax, [esp + 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x2b8]
push eax
lea ecx, [esp + 0x348]
push ecx
call fcn.004a9000
add esp, 8
push 0xa
push str.Config.xml
lea ecx, [esp + 0x34c]
mov byte [esp + 0x269e0], 5
call fcn.0041ca40
lea edx, [esp + 0x2b8]
push edx
lea eax, [esp + 0x364]
push eax
call fcn.004a9000
add esp, 8
push 8
push str.temp.dat
lea ecx, [esp + 0x368]
mov byte [esp + 0x269e0], 6
call fcn.0041ca40
lea ecx, [esp + 0x158]
call fcn.0050a330
push 0x38
mov byte [esp + 0x269dc], 7
call fcn.004ca5aa
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x269d8], 8
cmp eax, ebx
je 0x4bef58
push 0x6015b5
push 0x607fcc
push 0x607fc8
mov ecx, eax
call fcn.0050a950
jmp 0x4bef5a
xor eax, eax
push eax
lea ecx, [esp + 0x15c]
mov byte [esp + 0x269dc], 7
call fcn.00509880
push 0x50
call fcn.004ca5aa
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x269d8], 9
cmp eax, ebx
je 0x4bef9b
push str.TheQueryInfo
mov ecx, eax
call fcn.0050ae30
mov dword [esp + 0x58], eax
jmp 0x4bef9f
mov dword [esp + 0x58], ebx
push 0x50
mov byte [esp + 0x269dc], 7
call fcn.004ca5aa
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x269d8], 0xa
cmp eax, ebx
je 0x4befd3
push str.PushList
mov ecx, eax
call fcn.0050ae30
mov dword [esp + 0x28], eax
jmp 0x4befd7
mov dword [esp + 0x28], ebx
mov esi, dword [ebp + 0x10]
mov byte [esp + 0x269d8], 7
cmp esi, dword [ebp + 0x14]
jbe 0x4befec
call fcn.004ea132
mov eax, dword [esp + 0x2c]
mov ebp, dword [eax + 4]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], esi
jmp 0x4bf000
mov esi, dword [eax + 0x14]
cmp dword [eax + 0x10], esi
jbe 0x4bf011
call fcn.004ea132
mov eax, dword [esp + 0x2c]
mov eax, dword [eax + 4]
cmp ebp, ebx
je 0x4bf01c
cmp ebp, eax
je 0x4bf021
call fcn.004ea132
cmp dword [esp + 0x24], esi
je 0x4c0966
cmp ebp, ebx
jne 0x4bf166
call fcn.004ea132
xor eax, eax
mov ecx, dword [esp + 0x24]
cmp ecx, dword [eax + 0x10]
jb 0x4bf048
call fcn.004ea132
mov edx, dword [esp + 0x24]
mov ebp, dword [edx + 0x1c]
push 8
xor eax, eax
push str.PushName
lea ecx, [esp + 0x1a8]
mov dword [esp + 0x1c0], edi
mov dword [esp + 0x1bc], ebx
mov word [esp + 0x1ac], ax
call fcn.00401c70
mov edx, dword [ebp]
mov edx, dword [edx + 0x1c]
lea eax, [esp + 0x1a0]
push eax
mov ecx, ebp
mov byte [esp + 0x269dc], 0xb
call edx
cmp dword [esp + 0x1b8], 8
mov dword [esp + 0x1c], eax
mov byte [esp + 0x269d8], 7
jb 0x4bf0ba
mov eax, dword [esp + 0x1a4]
push eax
call fcn.004ca5d9
add esp, 4
xor ecx, ecx
push 0xd
mov word [esp + 0x1a8], cx
xor edx, edx
push str.ChooseInstall
lea ecx, [esp + 0x1c4]
mov dword [esp + 0x1c0], edi
mov dword [esp + 0x1bc], ebx
mov dword [esp + 0x1dc], edi
mov dword [esp + 0x1d8], ebx
mov word [esp + 0x1c8], dx
call fcn.00401c70
mov eax, dword [ebp]
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 0x1bc]
push ecx
mov ecx, ebp
mov byte [esp + 0x269dc], 0xc
call edx
cmp dword [esp + 0x1d4], 8
mov esi, eax
mov byte [esp + 0x269d8], 7
jb 0x4bf13b
mov eax, dword [esp + 0x1c0]
push eax
call fcn.004ca5d9
add esp, 4
xor ecx, ecx
mov dword [esp + 0x1d4], edi
mov dword [esp + 0x1d0], ebx
mov word [esp + 0x1c0], cx
cmp esi, ebx
je 0x4c0931
cmp dword [esi + 0x18], 8
jb 0x4bf16e
mov eax, dword [esi + 4]
jmp 0x4bf171
mov eax, dword [ebp]
jmp 0x4bf03a
lea eax, [esi + 4]
mov ecx, str.true
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4bf19c
test dx, dx
je 0x4bf198
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4bf19c
add eax, 4
add ecx, 4
test dx, dx
jne 0x4bf176
xor eax, eax
jmp 0x4bf1a1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4c0931
push 0xe
xor edx, edx
xor ebx, ebx
push str.InstallPushUrl
lea ecx, [esp + 0x1e0]
mov dword [esp + 0x1f8], edi
mov dword [esp + 0x1f4], ebx
mov word [esp + 0x1e4], dx
call fcn.00401c70
mov eax, dword [ebp]
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 0x1d8]
push ecx
mov ecx, ebp
mov byte [esp + 0x269dc], 0xd
call edx
cmp dword [esp + 0x1f0], 8
mov esi, eax
mov byte [esp + 0x269d8], 7
jb 0x4bf214
mov eax, dword [esp + 0x1dc]
push eax
call fcn.004ca5d9
add esp, 4
xor ecx, ecx
push 0x12
mov word [esp + 0x1e0], cx
xor edx, edx
push str.InstallProgramName
lea ecx, [esp + 0x144]
mov dword [esp + 0x1f8], edi
mov dword [esp + 0x1f4], ebx
mov dword [esp + 0x15c], edi
mov dword [esp + 0x158], ebx
mov word [esp + 0x148], dx
call fcn.00401c70
mov eax, dword [ebp]
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 0x13c]
push ecx
mov ecx, ebp
mov byte [esp + 0x269dc], 0xe
call edx
cmp dword [esp + 0x154], 8
mov dword [esp + 0x74], eax
mov byte [esp + 0x269d8], 7
jb 0x4bf297
mov eax, dword [esp + 0x140]
push eax
call fcn.004ca5d9
add esp, 4
xor ecx, ecx
push 0x12
mov word [esp + 0x144], cx
xor edx, edx
push str.InstallAppDataName
lea ecx, [esp + 0xa8]
mov dword [esp + 0x15c], edi
mov dword [esp + 0x158], ebx
mov dword [esp + 0xc0], edi
mov dword [esp + 0xbc], ebx
mov word [esp + 0xac], dx
call fcn.00401c70
mov eax, dword [ebp]
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 0xa0]
push ecx
mov ecx, ebp
mov byte [esp + 0x269dc], 0xf
call edx
cmp dword [esp + 0xb8], 8
mov dword [esp + 0x68], eax
mov byte [esp + 0x269d8], 7
jb 0x4bf31a
mov eax, dword [esp + 0xa4]
push eax
call fcn.004ca5d9
add esp, 4
xor ecx, ecx
push 0xf
mov word [esp + 0xa8], cx
xor edx, edx
push str.InstallGreenBag
lea ecx, [esp + 0x26c]
mov dword [esp + 0xc0], edi
mov dword [esp + 0xbc], ebx
mov dword [esp + 0x284], edi
mov dword [esp + 0x280], ebx
mov word [esp + 0x270], dx
call fcn.00401c70
mov eax, dword [ebp]
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 0x264]
push ecx
mov ecx, ebp
mov byte [esp + 0x269dc], 0x10
call edx
cmp dword [esp + 0x27c], 8
mov dword [esp + 0x7c], eax
mov byte [esp + 0x269d8], 7
jb 0x4bf39d
mov eax, dword [esp + 0x268]
push eax
call fcn.004ca5d9
add esp, 4
xor ecx, ecx
push 0xf
mov word [esp + 0x26c], cx
xor edx, edx
push str.InstallRunParam
lea ecx, [esp + 0x128]
mov dword [esp + 0x284], edi
mov dword [esp + 0x280], ebx
mov dword [esp + 0x140], edi
mov dword [esp + 0x13c], ebx
mov word [esp + 0x12c], dx
call fcn.00401c70
mov eax, dword [ebp]
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 0x120]
push ecx
mov ecx, ebp
mov byte [esp + 0x269dc], 0x11
call edx
cmp dword [esp + 0x138], 8
mov dword [esp + 0x80], eax
mov byte [esp + 0x269d8], 7
jb 0x4bf423
mov eax, dword [esp + 0x124]
push eax
call fcn.004ca5d9
add esp, 4
xor ecx, ecx
push 0xd
mov word [esp + 0x128], cx
xor edx, edx
push str.InstallRunExe
lea ecx, [esp + 0x2a4]
mov dword [esp + 0x140], edi
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x2bc], edi
mov dword [esp + 0x2b8], ebx
mov word [esp + 0x2a8], dx
call fcn.00401c70
mov eax, dword [ebp]
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 0x29c]
push ecx
mov ecx, ebp
mov byte [esp + 0x269dc], 0x12
call edx
cmp dword [esp + 0x2b4], 8
mov dword [esp + 0x78], eax
mov byte [esp + 0x269d8], 7
jb 0x4bf4a6
mov eax, dword [esp + 0x2a0]
push eax
call fcn.004ca5d9
add esp, 4
xor ecx, ecx
push 0xd
mov word [esp + 0x2a4], cx
xor edx, edx
push str.InstallRunDll
lea ecx, [esp + 0x10c]
mov dword [esp + 0x2bc], edi
mov dword [esp + 0x2b8], ebx
mov dword [esp + 0x124], edi
mov dword [esp + 0x120], ebx
mov word [esp + 0x110], dx
call fcn.00401c70
mov eax, dword [ebp]
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 0x104]
push ecx
mov ecx, ebp
mov byte [esp + 0x269dc], 0x13
call edx
cmp dword [esp + 0x11c], 8
mov dword [esp + 0x64], eax
mov byte [esp + 0x269d8], 7
jb 0x4bf529
mov eax, dword [esp + 0x108]
push eax
call fcn.004ca5d9
add esp, 4
xor ecx, ecx
push 0xf
mov word [esp + 0x10c], cx
xor edx, edx
push str.InstallRunAdmin
lea ecx, [esp + 0xd4]
mov dword [esp + 0x124], edi
mov dword [esp + 0x120], ebx
mov dword [esp + 0xec], edi
mov dword [esp + 0xe8], ebx
mov word [esp + 0xd8], dx
call fcn.00401c70
mov eax, dword [ebp]
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 0xcc]
push ecx
mov ecx, ebp
mov byte [esp + 0x269dc], 0x14
call edx
cmp dword [esp + 0xe4], 8
mov dword [esp + 0x14], eax
mov byte [esp + 0x269d8], 7
jb 0x4bf5ac
mov eax, dword [esp + 0xd0]
push eax
call fcn.004ca5d9
add esp, 4
xor ecx, ecx
push 0x12
mov word [esp + 0xd4], cx
xor edx, edx
push str.InstallRunLocalExe
lea ecx, [esp + 0x250]
mov dword [esp + 0xec], edi
mov dword [esp + 0xe8], ebx
mov dword [esp + 0x268], edi
mov dword [esp + 0x264], ebx
mov word [esp + 0x254], dx
call fcn.00401c70
mov eax, dword [ebp]
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 0x248]
push ecx
mov ecx, ebp
mov byte [esp + 0x269dc], 0x15
call edx
cmp dword [esp + 0x260], 8
mov dword [esp + 0x70], eax
mov byte [esp + 0x269d8], 7
jb 0x4bf62f
mov eax, dword [esp + 0x24c]
push eax
call fcn.004ca5d9
add esp, 4
xor ecx, ecx
push 0xb
mov word [esp + 0x250], cx
xor edx, edx
push str.InstallType
lea ecx, [esp + 0xf0]
mov dword [esp + 0x268], edi
mov dword [esp + 0x264], ebx
mov dword [esp + 0x108], edi
mov dword [esp + 0x104], ebx
mov word [esp + 0xf4], dx
call fcn.00401c70
mov eax, dword [ebp]
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 0xe8]
push ecx
mov ecx, ebp
mov byte [esp + 0x269dc], 0x16
call edx
cmp dword [esp + 0x100], 8
mov dword [esp + 0x6c], eax
mov byte [esp + 0x269d8], 7
jb 0x4bf6b2
mov eax, dword [esp + 0xec]
push eax
call fcn.004ca5d9
add esp, 4
xor ecx, ecx
push 0xe
mov word [esp + 0xf0], cx
xor edx, edx
push str.InstallUACType
lea ecx, [esp + 0x8c]
mov dword [esp + 0x108], edi
mov dword [esp + 0x104], ebx
mov dword [esp + 0xa4], edi
mov dword [esp + 0xa0], ebx
mov word [esp + 0x90], dx
call fcn.00401c70
mov eax, dword [ebp]
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 0x84]
push ecx
mov ecx, ebp
mov byte [esp + 0x269dc], 0x17
call edx
cmp dword [esp + 0x9c], 8
mov dword [esp + 0x18], eax
mov byte [esp + 0x269d8], 7
jb 0x4bf735
mov eax, dword [esp + 0x88]
push eax
call fcn.004ca5d9
add esp, 4
xor ecx, ecx
push 0xe
mov word [esp + 0x8c], cx
xor edx, edx
push str.InstallWmiMode
lea ecx, [esp + 0x38]
mov dword [esp + 0xa4], edi
mov dword [esp + 0xa0], ebx
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebx
mov word [esp + 0x3c], dx
call fcn.00401c70
mov eax, dword [ebp]
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 0x30]
push ecx
mov ecx, ebp
mov byte [esp + 0x269dc], 0x18
call edx
cmp dword [esp + 0x48], 8
mov dword [esp + 0x5c], eax
mov byte [esp + 0x269d8], 7
jb 0x4bf7a3
mov eax, dword [esp + 0x34]
push eax
call fcn.004ca5d9
add esp, 4
xor ecx, ecx
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], cx
cmp dword [esp + 0x1c], ebx
je 0x4bfae0
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x18], 8
jb 0x4bf7cb
mov eax, dword [eax + 4]
jmp 0x4bf7ce
add eax, 4
mov ecx, str.zmbd
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4bf7f9
cmp dx, bx
je 0x4bf7f5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4bf7f9
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x4bf7d3
xor eax, eax
jmp 0x4bf7fe
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4bfae0
cmp dword [esi + 0x18], 8
jb 0x4bf811
mov edx, dword [esi + 4]
jmp 0x4bf814
lea edx, [esi + 4]
xor eax, eax
mov word [esp + 0x1c0], ax
mov eax, edx
mov dword [esp + 0x1d4], edi
mov dword [esp + 0x1d0], ebx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4bf831
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x1c4]
call fcn.00401c70
cmp dword [esp + 0x1d4], 8
mov eax, dword [esp + 0x1c0]
mov byte [esp + 0x269d8], 0x19
jae 0x4bf86e
lea eax, [esp + 0x1c0]
lea ecx, [esp + 0x267c4]
push ecx
push eax
call fcn.004a6b00
add esp, 8
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x218]
xor edx, edx
push eax
lea ecx, [esp + 0x1ac]
mov dword [esp + 0x1c4], edi
mov dword [esp + 0x1c0], ebx
mov word [esp + 0x1b0], dx
call fcn.00401f60
lea eax, [esp + 0x267c4]
mov byte [esp + 0x269d8], 0x1a
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4bf8c0
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x267c8]
push ecx
lea ecx, [esp + 0x1a8]
call fcn.00402e80
mov eax, dword [esp + 0x1a4]
mov esi, 8
cmp dword [esp + 0x1b8], esi
jae 0x4bf900
lea eax, [esp + 0x1a4]
push eax
call fcn.004a6f40
add esp, 4
lea ecx, [esp + 0xc4]
call fcn.005e0510
mov eax, dword [esp + 0x214]
mov byte [esp + 0x269d8], 0x1b
cmp dword [esp + 0x228], esi
jae 0x4bf934
lea eax, [esp + 0x214]
push eax
lea ecx, [esp + 0x34]
call fcn.00401720
mov eax, dword [esp + 0x1c0]
mov byte [esp + 0x269d8], 0x1c
cmp dword [esp + 0x1d4], esi
jae 0x4bf95d
lea eax, [esp + 0x1c0]
push eax
lea ecx, [esp + 0x1f8]
call fcn.00401720
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x1f8]
push eax
lea ecx, [esp + 0xcc]
mov byte [esp + 0x269e0], 0x1d
call fcn.005e05a0
lea ecx, [esp + 0x1f4]
movzx esi, al
call fcn.00401760
lea ecx, [esp + 0x30]
mov byte [esp + 0x269d8], 0x1b
call fcn.00401760
lea ecx, [esp + 0x30]
cmp esi, ebx
je 0x4bfa84
push str.true
call fcn.00401720
push str.DownloadFlag
lea ecx, [esp + 0x1f8]
mov byte [esp + 0x269dc], 0x1e
call fcn.00401720
mov edx, dword [ebp]
mov edx, dword [edx + 8]
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x1f8]
push ecx
mov ecx, ebp
mov byte [esp + 0x269e0], 0x1f
call edx
lea ecx, [esp + 0x1f4]
call fcn.00401760
lea ecx, [esp + 0x30]
mov byte [esp + 0x269d8], 0x1b
call fcn.00401760
cmp dword [esp + 0x1b8], 8
mov eax, dword [esp + 0x1a4]
jae 0x4bfa2e
lea eax, [esp + 0x1a4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
je 0x4bfa4b
push str.DownloaderHelper
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4bfa4b
call eax
lea ecx, [esp + 0xc4]
mov byte [esp + 0x269d8], 0x1a
call fcn.005e04f0
lea ecx, [esp + 0x1a0]
call fcn.00401760
lea ecx, [esp + 0x1bc]
mov byte [esp + 0x269d8], 7
call fcn.00401760
jmp 0x4c0931
push 0x61515c
call fcn.00401720
push str.DownloadFlag
lea ecx, [esp + 0x1f8]
mov byte [esp + 0x269dc], 0x20
call fcn.00401720
mov eax, dword [ebp]
mov eax, dword [eax + 8]
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x1f8]
push edx
mov ecx, ebp
mov byte [esp + 0x269e0], 0x21
call eax
lea ecx, [esp + 0x1f4]
call fcn.00401760
lea ecx, [esp + 0x30]
call fcn.00401760
jmp 0x4bfa4b
cmp esi, ebx
je 0x4c0931
mov ebx, 8
mov dword [esp + 0x54], 1
cmp dword [esi + 0x18], ebx
jb 0x4bfaff
mov eax, dword [esi + 4]
jmp 0x4bfb02
lea eax, [esi + 4]
push eax
lea ecx, [esp + 0x1f8]
call fcn.00401720
mov eax, dword [esp + 0x1f8]
mov byte [esp + 0x269d8], 0x22
cmp dword [esp + 0x20c], ebx
jae 0x4bfb2e
lea eax, [esp + 0x1f8]
lea ecx, [esp + 0x267c4]
push ecx
push eax
call fcn.004a6b00
add esp, 8
xor edx, edx
push 0xffffffffffffffff
push edx
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x238]
mov dword [esp + 0x250], edi
mov dword [esp + 0x24c], 0
mov word [esp + 0x23c], dx
call fcn.00401f60
lea eax, [esp + 0x267c4]
mov byte [esp + 0x269d8], 0x23
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4bfb84
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x267c8]
push ecx
lea ecx, [esp + 0x234]
call fcn.00402e80
mov eax, dword [esp + 0x230]
cmp dword [esp + 0x244], ebx
jae 0x4bfbbf
lea eax, [esp + 0x230]
push eax
call fcn.004a6f40
add esp, 4
lea ecx, [esp + 0xbc]
call fcn.005e0510
mov eax, dword [esp + 0x214]
mov byte [esp + 0x269d8], 0x24
cmp dword [esp + 0x228], ebx
jae 0x4bfbf3
lea eax, [esp + 0x214]
push eax
lea ecx, [esp + 0x1a4]
call fcn.00401720
mov eax, dword [esp + 0x1f8]
mov byte [esp + 0x269d8], 0x25
cmp dword [esp + 0x20c], ebx
jae 0x4bfc1f
lea eax, [esp + 0x1f8]
push eax
lea ecx, [esp + 0x1dc]
call fcn.00401720
lea edx, [esp + 0x1a0]
push edx
lea eax, [esp + 0x1dc]
push eax
lea ecx, [esp + 0xc4]
mov byte [esp + 0x269e0], 0x26
call fcn.005e05a0
mov esi, 8
movzx ebx, al
cmp dword [esp + 0x1f0], esi
jb 0x4bfc71
mov ecx, dword [esp + 0x1dc]
push ecx
call fcn.004ca5d9
add esp, 4
xor edx, edx
mov dword [esp + 0x1f0], edi
mov dword [esp + 0x1ec], 0
mov word [esp + 0x1dc], dx
mov byte [esp + 0x269d8], 0x24
cmp dword [esp + 0x1b8], esi
jb 0x4bfcae
mov eax, dword [esp + 0x1a4]
push eax
call fcn.004ca5d9
add esp, 4
test ebx, ebx
jne 0x4bfe32
lea ecx, [esp + 0x1f4]
push ecx
lea edx, [esp + 0x1dc]
push edx
mov ebx, 1
call fcn.004a9000
mov esi, 0x10
add esp, 8
cmp dword [eax + 0x18], esi
jb 0x4bfce2
mov ecx, dword [eax + 4]
jmp 0x4bfce5
lea ecx, [eax + 4]
lea edx, [esp + 0x37c]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4bfcf0
lea ecx, [esp + 0x1d8]
call fcn.00401700
lea eax, [esp + 0x210]
push eax
lea ecx, [esp + 0x1dc]
push ecx
call fcn.004a9000
add esp, 8
cmp dword [eax + 0x18], esi
jb 0x4bfd28
mov ecx, dword [eax + 4]
jmp 0x4bfd2b
lea ecx, [eax + 4]
lea edx, [esp + 0x57c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x4bfd32
lea ecx, [esp + 0x1d8]
call fcn.00401700
lea ecx, [esp + 0x994]
call fcn.004bbee0
sub esp, 0x300
mov edi, esp
mov ecx, 0xc0
lea esi, [esp + 0x67c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xc94]
mov byte [esp + 0x26cd8], 0x27
call fcn.004bc7d0
lea ecx, [esp + 0x994]
call fcn.004bc5a0
lea ecx, [esp + 0x67c]
call fcn.004bbe90
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
lea esp, [esp]
lea ecx, [esp + 0x994]
call fcn.004bbf90
test eax, eax
je 0x4bfdc8
lea edx, [esp + 0x67c]
push edx
lea ecx, [esp + 0x998]
call fcn.004bc580
push 0x64
call esi
lea ecx, [esp + 0x994]
call fcn.004bbfa0
test eax, eax
je 0x4bfda0
lea eax, [esp + 0x67c]
push eax
lea ecx, [esp + 0x998]
call fcn.004bc580
fld qword [esp + 0x984]
fld qword [esp + 0x98c]
fucom st(1)
fnstsw ax
fstp st(1)
test ah, 0x44
jp 0x4bfe12
fldz
fucompp
fnstsw ax
test ah, 0x44
jp 0x4bfe16
jmp 0x4bfe14
fstp st(0)
xor ebx, ebx
lea ecx, [esp + 0x994]
mov byte [esp + 0x269d8], 0x24
call fcn.004bbf80
test ebx, ebx
je 0x4bff11
push str.true
lea ecx, [esp + 0x1a4]
call fcn.00401720
push str.DownloadFlag
lea ecx, [esp + 0x1dc]
mov byte [esp + 0x269dc], 0x28
call fcn.00401720
mov edx, dword [ebp]
mov edx, dword [edx + 8]
lea eax, [esp + 0x1a0]
push eax
lea ecx, [esp + 0x1dc]
push ecx
mov ecx, ebp
mov byte [esp + 0x269e0], 0x29
call edx
lea ecx, [esp + 0x1d8]
call fcn.00401760
lea ecx, [esp + 0x1a0]
mov byte [esp + 0x269d8], 0x24
call fcn.00401760
test ebx, ebx
je 0x4c08bd
mov eax, dword [esp + 0x214]
mov esi, 8
cmp dword [esp + 0x228], esi
jae 0x4bfec2
lea eax, [esp + 0x214]
push eax
lea ecx, [esp + 0x1c0]
call fcn.00401720
lea ecx, [esp + 0x267c4]
push ecx
lea ecx, [esp + 0x1dc]
mov byte [esp + 0x269dc], 0x2c
call fcn.00401720
mov eax, dword [esp + 0x7c]
xor edi, edi
xor ebp, ebp
mov byte [esp + 0x269d8], 0x2d
mov dword [esp + 0x1c], edi
test eax, eax
je 0x4c020d
cmp dword [eax + 0x18], esi
jb 0x4bff6c
mov eax, dword [eax + 4]
jmp 0x4bff6f
push 0x61515c
lea ecx, [esp + 0x88]
call fcn.00401720
push str.DownloadFlag
lea ecx, [esp + 0x34]
mov byte [esp + 0x269dc], 0x2a
call fcn.00401720
mov eax, dword [ebp]
mov eax, dword [eax + 8]
lea ecx, [esp + 0x84]
push ecx
lea edx, [esp + 0x34]
push edx
mov ecx, ebp
mov byte [esp + 0x269e0], 0x2b
call eax
lea ecx, [esp + 0x30]
call fcn.00401760
lea ecx, [esp + 0x84]
jmp 0x4c08b8
add eax, 4
mov ecx, str.true
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4bff9a
test dx, dx
je 0x4bff96
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4bff9a
add eax, 4
add ecx, 4
test dx, dx
jne 0x4bff74
xor eax, eax
jmp 0x4bff9f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4c020d
mov edi, 1
push 0x5fd0cc
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x20], edi
mov dword [esp + 0x58], ebp
call fcn.00401720
mov esi, dword [esp + 0x74]
mov byte [esp + 0x269d8], 0x2e
test esi, esi
je 0x4c0067
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x386]
push eax
mov word [esp + 0x388], dx
call fcn.004e9ba0
add esp, 0xc
push 0
push 0x26
lea ecx, [esp + 0x384]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [esp + 0x37c]
push edx
lea ecx, [esp + 0x1a4]
call fcn.00402960
push 0x601624
lea ecx, [esp + 0x1a4]
call fcn.00402980
mov ebx, 8
cmp dword [esi + 0x18], ebx
jb 0x4c0041
mov eax, dword [esi + 4]
jmp 0x4c0044
lea eax, [esi + 4]
push eax
lea ecx, [esp + 0x1a4]
call fcn.00402980
push 0x601624
lea ecx, [esp + 0x1a4]
call fcn.00402980
jmp 0x4c0111
mov esi, dword [esp + 0x68]
test esi, esi
je 0x4c00f3
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x386]
push ecx
mov word [esp + 0x388], ax
call fcn.004e9ba0
add esp, 0xc
push 0
push 0x1a
lea edx, [esp + 0x384]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x37c]
push eax
lea ecx, [esp + 0x1a4]
call fcn.00402960
push 0x601624
lea ecx, [esp + 0x1a4]
call fcn.00402980
mov ecx, esi
call fcn.00401780
push eax
lea ecx, [esp + 0x1a4]
call fcn.00402980
push 0x601624
lea ecx, [esp + 0x1a4]
call fcn.00402980
jmp 0x4c010c
call fcn.00409730
mov ecx, eax
call fcn.004a3a20
push eax
lea ecx, [esp + 0x1a4]
call fcn.00402960
mov ebx, 8
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x1a8]
push ecx
lea ecx, [esp + 0x1c8]
call fcn.00401f60
mov eax, dword [esp + 0x214]
cmp dword [esp + 0x228], ebx
jae 0x4c0140
lea eax, [esp + 0x214]
push eax
lea ecx, [esp + 0x268]
call fcn.00401720
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x1e0]
push edx
lea ecx, [esp + 0x270]
mov byte [esp + 0x269e4], 0x2f
call fcn.00402fb0
lea eax, [esp + 0x264]
push eax
lea ecx, [esp + 0xa4]
push ecx
call fcn.004a9000
add esp, 8
cmp dword [eax + 0x18], 0x10
mov byte [esp + 0x269d8], 0x30
jb 0x4c0198
mov eax, dword [eax + 4]
jmp 0x4c019b
add eax, 4
mov ecx, dword [esp + 0x1a4]
cmp dword [esp + 0x1b8], ebx
jae 0x4c01b2
lea ecx, [esp + 0x1a4]
push 0
push eax
push ecx
call fcn.004bba50
add esp, 0xc
lea ecx, [esp + 0xa0]
call fcn.00401700
mov eax, dword [esp + 0x268]
cmp dword [esp + 0x27c], ebx
jae 0x4c01e1
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x264]
call fcn.00401760
lea ecx, [esp + 0x1a0]
mov byte [esp + 0x269d8], 0x2d
call fcn.00401760
mov esi, 8
mov eax, dword [esp + 0x78]
test eax, eax
je 0x4c02ae
cmp dword [eax + 0x18], esi
jb 0x4c0223
mov eax, dword [eax + 4]
jmp 0x4c0226
add eax, 4
push eax
lea ecx, [esp + 0x1dc]
call fcn.00402960
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x1e0]
push edx
lea ecx, [esp + 0x1c8]
call fcn.00402fb0
test edi, edi
jne 0x4c03a4
mov ecx, dword [esp + 0x1c0]
cmp dword [esp + 0x1d4], esi
jae 0x4c026a
lea ecx, [esp + 0x1c0]
mov eax, dword [esp + 0x230]
cmp dword [esp + 0x244], esi
jae 0x4c0281
lea eax, [esp + 0x230]
push ecx
push eax
call fcn.004a6c70
mov eax, dword [esp + 0x238]
add esp, 8
cmp dword [esp + 0x244], esi
jae 0x4c02a2
lea eax, [esp + 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4c03a4
mov eax, dword [esp + 0x64]
test eax, eax
je 0x4c0390
mov ebp, 1
cmp dword [eax + 0x18], esi
jb 0x4c02c9
mov eax, dword [eax + 4]
jmp 0x4c02cc
add eax, 4
push eax
lea ecx, [esp + 0x1dc]
call fcn.00402960
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x1e0]
push eax
lea ecx, [esp + 0x1c8]
call fcn.00402fb0
test edi, edi
jne 0x4c032a
lea ecx, [esp + 0x1bc]
call fcn.00401780
push eax
lea ecx, [esp + 0x230]
call fcn.00401780
push eax
call fcn.004a6c70
add esp, 8
lea ecx, [esp + 0x22c]
call fcn.00401780
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x1bc]
push ecx
lea ecx, [esp + 0x2a0]
call fcn.00402900
mov eax, dword [esp + 0x2a0]
mov byte [esp + 0x269d8], 0x31
cmp dword [esp + 0x2b4], esi
jae 0x4c035d
lea eax, [esp + 0x2a0]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4c037a
push str.Install_7z
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4c037a
call eax
lea ecx, [esp + 0x29c]
mov byte [esp + 0x269d8], 0x2d
call fcn.00401760
jmp 0x4c03a4
lea edx, [esp + 0x267c4]
push edx
lea ecx, [esp + 0x1c0]
call fcn.00402980
mov esi, dword [esp + 0x70]
test esi, esi
je 0x4c03df
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x2c0]
push eax
lea ecx, [esp + 0x1c8]
call fcn.00401f60
cmp dword [esi + 0x18], 8
jb 0x4c03cf
mov eax, dword [esi + 4]
jmp 0x4c03d2
lea eax, [esi + 4]
push eax
lea ecx, [esp + 0x1c0]
call fcn.00402980
test ebp, ebp
jne 0x4c08a5
push 0x5fd0cc
lea ecx, [esp + 0x24c]
call fcn.00401720
mov edi, dword [esp + 0x80]
mov byte [esp + 0x269d8], 0x32
test edi, edi
jne 0x4c0424
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x1c4]
push ecx
lea ecx, [esp + 0x254]
call fcn.00402fb0
jmp 0x4c0479
push 0x60031c
lea ecx, [esp + 0x24c]
call fcn.00402980
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x1c4]
push edx
lea ecx, [esp + 0x254]
call fcn.00402fb0
push 0x600314
lea ecx, [esp + 0x24c]
call fcn.00402980
cmp dword [edi + 0x18], 8
jb 0x4c0469
mov eax, dword [edi + 4]
jmp 0x4c046c
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0x24c]
call fcn.00402980
mov ebx, dword [esp + 0x6c]
test ebx, ebx
je 0x4c085a
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x4c04ce
mov esi, str.true
call fcn.00401780
mov cx, word [eax]
cmp cx, word [esi]
jne 0x4c04bd
test cx, cx
je 0x4c04b9
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x4c04bd
add eax, 4
add esi, 4
test cx, cx
jne 0x4c0497
xor eax, eax
jmp 0x4c04c2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4c04ce
mov dword [esp + 0x50], 1
cmp dword [ebx + 0x18], 8
jb 0x4c04d9
mov eax, dword [ebx + 4]
jmp 0x4c04dc
lea eax, [ebx + 4]
mov ecx, str.open_explorer
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4c0507
test dx, dx
je 0x4c0503
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4c0507
add eax, 4
add ecx, 4
test dx, dx
jne 0x4c04e1
xor eax, eax
jmp 0x4c050c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4c085a
call fcn.004a7540
test eax, eax
je 0x4c05b3
mov ebx, dword [esp + 0x18]
test ebx, ebx
je 0x4c05b3
mov ecx, ebx
mov esi, str.direct_open
call fcn.00401780
lea esp, [esp]
mov cx, word [eax]
cmp cx, word [esi]
jne 0x4c0566
test cx, cx
je 0x4c0562
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x4c0566
add eax, 4
add esi, 4
test cx, cx
jne 0x4c0540
xor eax, eax
jmp 0x4c056b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4c085a
mov ecx, ebx
mov esi, str.no_open
call fcn.00401780
nop
mov cx, word [eax]
cmp cx, word [esi]
jne 0x4c05a6
test cx, cx
je 0x4c05a2
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x4c05a6
add eax, 4
add esi, 4
test cx, cx
jne 0x4c0580
xor eax, eax
jmp 0x4c05ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4c086f
push 0x50
mov dword [esp + 0x50], 1
call fcn.004ca5aa
add esp, 4
mov dword [esp + 0x18], eax
mov byte [esp + 0x269d8], 0x33
test eax, eax
je 0x4c05e5
push str.PushItem
mov ecx, eax
call fcn.0050ae30
mov ebp, eax
jmp 0x4c05e7
xor ebp, ebp
push 0x50
mov byte [esp + 0x269dc], 0x32
call fcn.004ca5aa
add esp, 4
mov dword [esp + 0x18], eax
mov byte [esp + 0x269d8], 0x34
test eax, eax
je 0x4c0619
push 0x615dbc
mov ecx, eax
call fcn.0050ae30
mov esi, eax
jmp 0x4c061b
xor esi, esi
push 0x1f3
lea eax, [esp + 0x381]
push 0
push eax
mov byte [esp + 0x269e4], 0x32
mov byte [esp + 0x388], 0
call fcn.004e9ba0
add esp, 0xc
lea ecx, [esp + 0x37c]
push ecx
lea ecx, [esp + 0x1c0]
call fcn.00401780
push eax
call fcn.004a6170
push 0x30
call fcn.004ca5aa
add esp, 0xc
mov dword [esp + 0x18], eax
mov byte [esp + 0x269d8], 0x35
test eax, eax
je 0x4c0687
lea edx, [esp + 0x37c]
push edx
mov ecx, eax
call fcn.0044d5f0
jmp 0x4c0689
xor eax, eax
push eax
mov ecx, esi
mov byte [esp + 0x269dc], 0x32
call fcn.00509880
push esi
mov ecx, ebp
call fcn.00509880
push 0x50
call fcn.004ca5aa
add esp, 4
mov dword [esp + 0x18], eax
mov byte [esp + 0x269d8], 0x36
test eax, eax
je 0x4c06cb
push 0x615dac
mov ecx, eax
call fcn.0050ae30
mov esi, eax
jmp 0x4c06cd
xor esi, esi
mov byte [esp + 0x269d8], 0x32
test edi, edi
je 0x4c0733
lea eax, [esp + 0x37c]
push eax
mov ecx, edi
call fcn.00401780
push eax
call fcn.004a6170
push 0x30
call fcn.004ca5aa
add esp, 0xc
mov dword [esp + 0x18], eax
mov byte [esp + 0x269d8], 0x37
test eax, eax
je 0x4c0719
lea ecx, [esp + 0x37c]
push ecx
mov ecx, eax
call fcn.0044d5f0
jmp 0x4c071b
xor eax, eax
push eax
mov ecx, esi
mov byte [esp + 0x269dc], 0x32
call fcn.00509880
push esi
mov ecx, ebp
call fcn.00509880
cmp dword [esp + 0x1c], 0
jne 0x4c07b4
push 0x50
call fcn.004ca5aa
add esp, 4
mov dword [esp + 0x18], eax
mov byte [esp + 0x269d8], 0x38
test eax, eax
je 0x4c0768
push str.InstallReBootDel
mov ecx, eax
call fcn.0050ae30
mov esi, eax
jmp 0x4c076a
xor esi, esi
push 0x30
mov byte [esp + 0x269dc], 0x32
call fcn.004ca5aa
add esp, 4
mov dword [esp + 0x18], eax
mov byte [esp + 0x269d8], 0x39
test eax, eax
je 0x4c079a
push 0x601cd8
mov ecx, eax
call fcn.0044d5f0
jmp 0x4c079c
xor eax, eax
push eax
mov ecx, esi
mov byte [esp + 0x269dc], 0x32
call fcn.00509880
push esi
mov ecx, ebp
call fcn.00509880
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x4c084e
push 0x50
call fcn.004ca5aa
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x269d8], 0x3a
test eax, eax
je 0x4c07ea
push 0x615d88
mov ecx, eax
call fcn.0050ae30
mov esi, eax
jmp 0x4c07ec
xor esi, esi
lea edx, [esp + 0x37c]
push edx
mov ecx, ebx
mov byte [esp + 0x269dc], 0x32
call fcn.00401780
push eax
call fcn.004a6170
push 0x30
call fcn.004ca5aa
add esp, 0xc
mov dword [esp + 0x14], eax
mov byte [esp + 0x269d8], 0x3b
test eax, eax
je 0x4c0834
lea ecx, [esp + 0x37c]
push ecx
mov ecx, eax
call fcn.0044d5f0
jmp 0x4c0836
xor eax, eax
push eax
mov ecx, esi
mov byte [esp + 0x269dc], 0x32
call fcn.00509880
push esi
mov ecx, ebp
call fcn.00509880
mov ecx, dword [esp + 0x28]
push ebp
call fcn.00509880
jmp 0x4c086f
lea ecx, [esp + 0x248]
call fcn.00401780
push eax
call fcn.004a8220
add esp, 4
cmp dword [esp + 0x54], 0
je 0x4c0899
cmp dword [esp + 0x1d4], 8
mov eax, dword [esp + 0x1c0]
jae 0x4c088e
lea eax, [esp + 0x1c0]
push 5
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [esp + 0x248]
call fcn.00401760
lea ecx, [esp + 0x1d8]
call fcn.00401760
lea ecx, [esp + 0x1bc]
call fcn.00401760
lea ecx, [esp + 0xbc]
mov byte [esp + 0x269d8], 0x23
call fcn.005e04f0
mov esi, 8
cmp dword [esp + 0x244], esi
jb 0x4c08ef
mov edx, dword [esp + 0x230]
push edx
call fcn.004ca5d9
add esp, 4
xor eax, eax
mov edi, 7
mov dword [esp + 0x244], edi
mov dword [esp + 0x240], 0
mov word [esp + 0x230], ax
mov byte [esp + 0x269d8], 7
cmp dword [esp + 0x20c], esi
jb 0x4c0931
mov ecx, dword [esp + 0x1f8]
push ecx
call fcn.004ca5d9
add esp, 4
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x4c0962
call fcn.004ea132
xor eax, eax
mov edx, dword [esp + 0x24]
cmp edx, dword [eax + 0x10]
jb 0x4c094e
call fcn.004ea132
add dword [esp + 0x24], 0x20
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
xor ebx, ebx
jmp 0x4bf000
mov eax, dword [eax]
jmp 0x4c0940
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x58]
push eax
mov ecx, esi
call fcn.00509880
push esi
lea ecx, [esp + 0x15c]
call fcn.00509880
cmp dword [esp + 0x308], 0x10
mov eax, dword [esp + 0x2f4]
jae 0x4c099b
lea eax, [esp + 0x2f4]
push eax
lea ecx, [esp + 0x15c]
call fcn.0050a5e0
mov eax, dword [esp + 0x284]
xor ebx, ebx
cmp dword [esp + 0x298], 8
jae 0x4c09c2
lea eax, [esp + 0x284]
push 0
push 0x80
push 4
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4c09ed
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edi, [ebx + 1]
push edi
call fcn.004ca5e4
push edi
mov ebp, eax
push 0
push ebp
call fcn.004e9ba0
add esp, 0x10
push 0
lea ecx, [esp + 0x64]
push ecx
push edi
push ebp
push esi
mov dword [esp + 0x74], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x344]
push edx
lea eax, [esp + 0x32c]
push eax
call fcn.004a93a0
add esp, 8
cmp dword [esp + 0x298], 8
mov eax, dword [esp + 0x284]
mov byte [esp + 0x269d8], 0x3c
jae 0x4c0a5b
lea eax, [esp + 0x284]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
xor eax, eax
xor ecx, ecx
cmp ebx, edi
jle 0x4c0a88
lea esp, [esp]
mov dl, byte [eax + str.GUANGSU]
xor byte [ecx + ebp], dl
inc eax
xor edi, edi
cmp eax, 7
jl 0x4c0a83
xor eax, eax
inc ecx
cmp ecx, ebx
jl 0x4c0a70
mov eax, dword [esp + 0x32c]
mov esi, 8
cmp dword [esp + 0x340], esi
jae 0x4c0aa4
lea eax, [esp + 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esp + 0x360]
push eax
lea ecx, [esp + 0x2d8]
push ecx
call fcn.004a93a0
add esp, 8
mov eax, dword [esp + 0x2d8]
mov byte [esp + 0x269d8], 0x3d
cmp dword [esp + 0x2ec], esi
jae 0x4c0ae2
lea eax, [esp + 0x2d8]
push eax
call fcn.004a6f40
mov eax, dword [esp + 0x2dc]
add esp, 4
cmp dword [esp + 0x2ec], esi
jae 0x4c0b02
lea eax, [esp + 0x2d8]
push edi
push 0x80
push 1
push edi
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4c0b3a
push edi
lea edx, [esp + 0x18]
push edx
push ebx
push ebp
push esi
mov dword [esp + 0x28], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x4c], edi
je 0x4c0d5c
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
xor eax, eax
mov esi, 7
push 0x5fd0cc
lea ecx, [esp + 0x1fc]
mov dword [esp + 0x214], esi
mov dword [esp + 0x210], edi
mov word [esp + 0x200], ax
call fcn.00401c70
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x2c0]
push ecx
lea ecx, [esp + 0x200]
mov byte [esp + 0x269e4], 0x3e
call fcn.00401f60
push 0xa
push str.Util32.exe
lea ecx, [esp + 0x1fc]
call fcn.00402e80
push edi
xor edx, edx
push 0x5fd0cc
lea ecx, [esp + 0x1a8]
mov dword [esp + 0x1c0], esi
mov dword [esp + 0x1bc], edi
mov word [esp + 0x1ac], dx
call fcn.00401c70
push 1
push 0x60031c
lea ecx, [esp + 0x1a8]
mov byte [esp + 0x269e0], 0x3f
call fcn.00401c70
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x1fc]
push eax
lea ecx, [esp + 0x1ac]
call fcn.00402fb0
push 0x22
push str.__AA845DC19AA540528A70AC50A26B005D
lea ecx, [esp + 0x1a8]
call fcn.00402e80
cmp dword [esp + 0x50], edi
jne 0x4c0c4c
mov eax, dword [esp + 0x1a4]
mov ebx, 8
cmp dword [esp + 0x1b8], ebx
jae 0x4c0c41
lea eax, [esp + 0x1a4]
push eax
call fcn.004a8220
jmp 0x4c0d0d
xor ecx, ecx
push edi
mov word [esp + 0x1c4], cx
push 0x5fd0cc
lea ecx, [esp + 0x1c4]
mov dword [esp + 0x1dc], esi
mov dword [esp + 0x1d8], edi
call fcn.00401c70
push 1
push 0x60031c
lea ecx, [esp + 0x1c4]
mov byte [esp + 0x269e0], 0x40
call fcn.00401c70
push 0xffffffffffffffff
push edi
lea edx, [esp + 0x314]
push edx
lea ecx, [esp + 0x1c8]
call fcn.00402fb0
push 2
push 0x600314
lea ecx, [esp + 0x1c4]
call fcn.00402e80
push 0xffffffffffffffff
push edi
lea eax, [esp + 0x1fc]
push eax
lea ecx, [esp + 0x1c8]
call fcn.00402fb0
mov eax, dword [esp + 0x1c0]
mov ebx, 8
cmp dword [esp + 0x1d4], ebx
jae 0x4c0cee
lea eax, [esp + 0x1c0]
push eax
call fcn.004a8220
add esp, 4
cmp dword [esp + 0x1d4], ebx
jb 0x4c0d10
mov ecx, dword [esp + 0x1c0]
push ecx
call fcn.004ca5d9
add esp, 4
cmp dword [esp + 0x1b8], ebx
jb 0x4c0d29
mov edx, dword [esp + 0x1a4]
push edx
call fcn.004ca5d9
add esp, 4
xor eax, eax
mov dword [esp + 0x1b8], esi
mov dword [esp + 0x1b4], edi
mov word [esp + 0x1a4], ax
cmp dword [esp + 0x20c], ebx
jb 0x4c0d64
mov ecx, dword [esp + 0x1f8]
push ecx
call fcn.004ca5d9
add esp, 4
jmp 0x4c0d64
mov ebx, 8
lea esi, [ebx - 1]
push ebp
call fcn.004ca5d9
add esp, 4
cmp dword [esp + 0x2ec], ebx
jb 0x4c0d86
mov edx, dword [esp + 0x2d8]
push edx
call fcn.004ca5d9
add esp, 4
xor eax, eax
mov dword [esp + 0x2ec], esi
mov dword [esp + 0x2e8], edi
mov word [esp + 0x2d8], ax
cmp dword [esp + 0x340], ebx
jb 0x4c0db7
mov ecx, dword [esp + 0x32c]
push ecx
call fcn.004ca5d9
add esp, 4
mov eax, dword [esp + 0x18c]
xor edx, edx
mov dword [esp + 0x340], esi
mov dword [esp + 0x33c], edi
mov word [esp + 0x32c], dx
mov byte [esp + 0x269d8], 6
mov dword [esp + method.TiXmlDocument.virtual_0], vtable.TiXmlDocument.0
cmp eax, 0x712674
je 0x4c0df9
push eax
call fcn.004ca5d9
add esp, 4
lea ecx, [esp + 0x158]
call fcn.00509fc0
cmp dword [esp + 0x378], 0x10
jb 0x4c0e1f
mov eax, dword [esp + 0x364]
push eax
call fcn.004ca5d9
add esp, 4
cmp dword [esp + 0x35c], 0x10
mov ebp, 0xf
mov dword [esp + 0x378], ebp
mov dword [esp + 0x374], edi
mov byte [esp + 0x364], 0
jb 0x4c0e54
mov ecx, dword [esp + 0x348]
push ecx
call fcn.004ca5d9
add esp, 4
mov dword [esp + 0x35c], ebp
mov dword [esp + 0x358], edi
mov byte [esp + 0x348], 0
cmp dword [esp + 0x298], ebx
jb 0x4c0e83
mov edx, dword [esp + 0x284]
push edx
call fcn.004ca5d9
add esp, 4
xor eax, eax
cmp dword [esp + 0x308], 0x10
mov dword [esp + 0x298], esi
mov dword [esp + 0x294], edi
mov word [esp + 0x284], ax
jb 0x4c0eb5
mov ecx, dword [esp + 0x2f4]
push ecx
call fcn.004ca5d9
add esp, 4
mov dword [esp + 0x308], ebp
mov dword [esp + 0x304], edi
mov byte [esp + 0x2f4], 0
cmp dword [esp + 0x324], ebx
jb 0x4c0ee4
mov edx, dword [esp + 0x310]
push edx
call fcn.004ca5d9
add esp, 4
xor eax, eax
mov dword [esp + 0x324], esi
mov dword [esp + 0x320], edi
mov word [esp + 0x310], ax
cmp dword [esp + 0x228], ebx
jb 0x4c0f15
mov ecx, dword [esp + 0x214]
push ecx
call fcn.004ca5d9
add esp, 4
xor edx, edx
mov dword [esp + 0x228], esi
mov dword [esp + 0x224], edi
mov word [esp + 0x214], dx
cmp dword [esp + 0x2d0], ebx
jb 0x4c0f46
mov eax, dword [esp + 0x2bc]
push eax
call fcn.004ca5d9
add esp, 4
mov ecx, dword [esp + 0x269d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x269b8]
xor ecx, esp
call fcn.004e8c89
add esp, 0x269c8
ret 4