Function at 0x42ca90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471b02
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x888
mov dword [ebp - 0x10], ecx
push str.DisplayName
lea ecx, [ebp - 0xcc]
call fcn.00404640
mov dword [ebp - 4], 0
push 0x488020
lea ecx, [ebp - 0xb4]
call fcn.00404640
mov byte [ebp - 4], 1
push 0x4880a0
lea ecx, [ebp - 0x9c]
call fcn.00404640
mov byte [ebp - 4], 2
push 0
lea eax, [ebp - 0xcc]
push eax
lea ecx, [ebp - 0xb4]
push ecx
lea edx, [ebp - 0x9c]
push edx
lea ecx, [ebp - 0x7dc]
call fcn.00413080
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x9c]
call fcn.00404510
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb4]
call fcn.00404510
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xcc]
call fcn.00404510
push 0x4880c8
lea ecx, [ebp - 0x7dc]
call fcn.004133f0
push str.Publisher
lea ecx, [ebp - 0x114]
call fcn.00404640
mov byte [ebp - 4], 7
push 0x4880d8
lea ecx, [ebp - 0xfc]
call fcn.00404640
mov byte [ebp - 4], 8
push 0x488158
lea ecx, [ebp - 0xe4]
call fcn.00404640
mov byte [ebp - 4], 9
push 0
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0xfc]
push ecx
lea edx, [ebp - 0xe4]
push edx
lea ecx, [ebp - 0x574]
call fcn.00413080
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xe4]
call fcn.00404510
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xfc]
call fcn.00404510
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x114]
call fcn.00404510
push 0x488180
lea ecx, [ebp - 0x574]
call fcn.004133f0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x574]
call fcn.00413120
push str.DisplayIcon
lea ecx, [ebp - 0x15c]
call fcn.00404640
mov byte [ebp - 4], 0xe
push 0x4881a0
lea ecx, [ebp - 0x144]
call fcn.00404640
mov byte [ebp - 4], 0xf
push 0x488220
lea ecx, [ebp - 0x12c]
call fcn.00404640
mov byte [ebp - 4], 0x10
push 0
lea eax, [ebp - 0x15c]
push eax
lea ecx, [ebp - 0x144]
push ecx
lea edx, [ebp - 0x12c]
push edx
lea ecx, [ebp - 0x5ac]
call fcn.00413080
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x12c]
call fcn.00404510
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x144]
call fcn.00404510
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x15c]
call fcn.00404510
push 0x488248
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
lea ecx, [ebp - 0x174]
push ecx
call fcn.0040b210
add esp, 0xc
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x174]
call fcn.00404370
push eax
lea ecx, [ebp - 0x5ac]
call fcn.004133f0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x174]
call fcn.00404510
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x5ac]
call fcn.00413120
push 0x48826c
lea ecx, [ebp - 0x1bc]
call fcn.00404640
mov byte [ebp - 4], 0x16
push 0x4882b0
lea ecx, [ebp - 0x1a4]
call fcn.00404640
mov byte [ebp - 4], 0x17
push 0x488330
lea ecx, [ebp - 0x18c]
call fcn.00404640
mov byte [ebp - 4], 0x18
push 0
lea edx, [ebp - 0x1bc]
push edx
lea eax, [ebp - 0x1a4]
push eax
lea ecx, [ebp - 0x18c]
push ecx
lea ecx, [ebp - 0x5e4]
call fcn.00413080
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x18c]
call fcn.00404510
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1a4]
call fcn.00404510
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1bc]
call fcn.00404510
push 0x48828c
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
lea eax, [ebp - 0x1d4]
push eax
call fcn.0040b210
add esp, 0xc
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x1d4]
call fcn.00404370
push eax
lea ecx, [ebp - 0x5e4]
call fcn.004133f0
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1d4]
call fcn.00404510
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x5e4]
call fcn.00413120
push str.UninstallString
lea ecx, [ebp - 0x21c]
call fcn.00404640
mov byte [ebp - 4], 0x1e
push 0x488378
lea ecx, [ebp - 0x204]
call fcn.00404640
mov byte [ebp - 4], 0x1f
push 0x4883f8
lea ecx, [ebp - 0x1ec]
call fcn.00404640
mov byte [ebp - 4], 0x20
push 0
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x204]
push edx
lea eax, [ebp - 0x1ec]
push eax
lea ecx, [ebp - 0x61c]
call fcn.00413080
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x1ec]
call fcn.00404510
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x204]
call fcn.00404510
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x21c]
call fcn.00404510
push str.uninstaller.exe
mov ecx, dword [ebp - 0x10]
add ecx, 4
push ecx
lea edx, [ebp - 0x234]
push edx
call fcn.0040b210
add esp, 0xc
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x234]
call fcn.00404370
push eax
lea ecx, [ebp - 0x61c]
call fcn.004133f0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x234]
call fcn.00404510
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x61c]
call fcn.00413120
push str.DisplayVersion
lea ecx, [ebp - 0x27c]
call fcn.00404640
mov byte [ebp - 4], 0x26
push 0x488480
lea ecx, [ebp - 0x264]
call fcn.00404640
mov byte [ebp - 4], 0x27
push 0x488500
lea ecx, [ebp - 0x24c]
call fcn.00404640
mov byte [ebp - 4], 0x28
push 0
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x264]
push ecx
lea edx, [ebp - 0x24c]
push edx
lea ecx, [ebp - 0x654]
call fcn.00413080
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x24c]
call fcn.00404510
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x264]
call fcn.00404510
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x27c]
call fcn.00404510
push str._version.json
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
lea ecx, [ebp - 0x2c4]
push ecx
call fcn.0040b210
add esp, 0xc
mov byte [ebp - 4], 0x2d
push 1
push 0x40
push 1
lea ecx, [ebp - 0x2c4]
call fcn.00404370
push eax
lea ecx, [ebp - 0x894]
call fcn.00404e50
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x894]
call fcn.00404db0
movzx edx, al
test edx, edx
je 0x42d0f1
lea ecx, [ebp - 0x12]
call fcn.00404bc0
push eax
lea ecx, [ebp - 0x7c]
call fcn.0042ec50
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x894]
push eax
lea ecx, [ebp - 0x84]
call fcn.0042ebe0
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x2ac]
call fcn.0042f1b0
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x894]
call fcn.00404d80
push 0
push 0x400
push 0
lea ecx, [ebp - 0x4f4]
call fcn.0041eca0
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x2ac]
call fcn.004047a0
push eax
lea ecx, [ebp - 0x4f4]
call fcn.0042ece0
mov ecx, eax
call fcn.0041ec30
movzx eax, al
test eax, eax
jne 0x42d0bd
push 0x488528
lea ecx, [ebp - 0x4f4]
call fcn.0041edf0
movzx ecx, al
test ecx, ecx
je 0x42d0a7
push str.version
push 0x48852c
lea ecx, [ebp - 0x4f4]
call fcn.0041fe40
mov ecx, eax
call fcn.0041fe40
mov ecx, eax
call fcn.0041ed80
push eax
lea ecx, [ebp - 0x74]
call fcn.00404ab0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x74]
call fcn.00404350
push eax
lea ecx, [ebp - 0x74]
call fcn.004047a0
push eax
lea edx, [ebp - 0x294]
push edx
call fcn.00414a70
add esp, 0xc
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x294]
call fcn.00404370
push eax
lea ecx, [ebp - 0x654]
call fcn.004133f0
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x294]
call fcn.00404510
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x74]
call fcn.00404920
jmp 0x42d0bb
push str.TAInstall::OperateUninstallReg_version.json_no_TA_
push 5
push 0x4981a8
call fcn.0040ee50
add esp, 0xc
jmp 0x42d0d1
push str.TAInstall::OperateUninstallReg_Parse_version.json_failed_
push 5
push 0x4981a8
call fcn.0040ee50
add esp, 0xc
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x4f4]
call fcn.0041ec50
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x2ac]
call fcn.00404920
jmp 0x42d105
push str.TAInstall::OperateUninstallReg_open_version.json_failed_
push 5
push 0x4981a8
call fcn.0040ee50
add esp, 0xc
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x894]
call fcn.00403490
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x2c4]
call fcn.00404510
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x654]
call fcn.00413120
push str.InstallDir
lea ecx, [ebp - 0x30c]
call fcn.00404640
mov byte [ebp - 4], 0x33
push 0x488608
lea ecx, [ebp - 0x2f4]
call fcn.00404640
mov byte [ebp - 4], 0x34
push 0x488688
lea ecx, [ebp - 0x2dc]
call fcn.00404640
mov byte [ebp - 4], 0x35
push 0
lea eax, [ebp - 0x30c]
push eax
lea ecx, [ebp - 0x2f4]
push ecx
lea edx, [ebp - 0x2dc]
push edx
lea ecx, [ebp - 0x68c]
call fcn.00413080
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x2dc]
call fcn.00404510
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x2f4]
call fcn.00404510
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x30c]
call fcn.00404510
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00404370
push eax
lea ecx, [ebp - 0x68c]
call fcn.004133f0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x68c]
call fcn.00413120
push str.path
lea ecx, [ebp - 0x354]
call fcn.00404640
mov byte [ebp - 4], 0x3a
push 0x4886b0
lea ecx, [ebp - 0x33c]
call fcn.00404640
mov byte [ebp - 4], 0x3b
push 0x488738
lea ecx, [ebp - 0x324]
call fcn.00404640
mov byte [ebp - 4], 0x3c
push 0
lea eax, [ebp - 0x354]
push eax
lea ecx, [ebp - 0x33c]
push ecx
lea edx, [ebp - 0x324]
push edx
lea ecx, [ebp - 0x6c4]
call fcn.00413080
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x324]
call fcn.00404510
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x33c]
call fcn.00404510
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x354]
call fcn.00404510
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.00404370
push eax
lea ecx, [ebp - 0x6c4]
call fcn.004133f0
movzx eax, al
test eax, eax
jne 0x42d2a0
push str.RegWrite_path_failed_
push 5
push 0x4981a8
call fcn.0040ee50
add esp, 0xc
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6c4]
call fcn.00413120
push 0x488778
lea ecx, [ebp - 0x39c]
call fcn.00404640
mov byte [ebp - 4], 0x41
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsTrustAgent.exe
lea ecx, [ebp - 0x384]
call fcn.00404640
mov byte [ebp - 4], 0x42
push 0x488840
lea ecx, [ebp - 0x36c]
call fcn.00404640
mov byte [ebp - 4], 0x43
push 0
lea ecx, [ebp - 0x39c]
push ecx
lea edx, [ebp - 0x384]
push edx
lea eax, [ebp - 0x36c]
push eax
lea ecx, [ebp - 0x6fc]
call fcn.00413080
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x36c]
call fcn.00404510
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x384]
call fcn.00404510
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x39c]
call fcn.00404510
push 0x48877c
mov ecx, dword [ebp - 0x10]
add ecx, 4
push ecx
lea edx, [ebp - 0x3b4]
push edx
call fcn.0040b210
add esp, 0xc
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x3b4]
call fcn.00404370
push eax
lea ecx, [ebp - 0x6fc]
call fcn.004133f0
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x3b4]
call fcn.00404510
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6fc]
call fcn.00413120
push str.ProxyVersion
lea ecx, [ebp - 0x3fc]
call fcn.00404640
mov byte [ebp - 4], 0x49
push 0x488868
lea ecx, [ebp - 0x3e4]
call fcn.00404640
mov byte [ebp - 4], 0x4a
push 0x4888e8
lea ecx, [ebp - 0x3cc]
call fcn.00404640
mov byte [ebp - 4], 0x4b
push 0
lea eax, [ebp - 0x3fc]
push eax
lea ecx, [ebp - 0x3e4]
push ecx
lea edx, [ebp - 0x3cc]
push edx
lea ecx, [ebp - 0x734]
call fcn.00413080
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x3cc]
call fcn.00404510
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x3e4]
call fcn.00404510
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x3fc]
call fcn.00404510
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
lea ecx, [ebp - 0x44]
call fcn.004046e0
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x50c]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.0042bf30
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 4], 0x51
mov eax, dword [ebp - 0x1c]
push eax
push 0x488910
call fcn.0042f250
add esp, 8
mov byte [ebp - 0x11], al
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x50c]
call fcn.00404920
movzx ecx, byte [ebp - 0x11]
test ecx, ecx
je 0x42d482
push str._trustproxy.sys
lea ecx, [ebp - 0x44]
call fcn.00404450
jmp 0x42d48f
push str._trustproxy64.sys
lea ecx, [ebp - 0x44]
call fcn.00404450
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x5c]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.0042e6a0
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x5c]
call fcn.00404320
movzx ecx, al
test ecx, ecx
jne 0x42d4ff
lea ecx, [ebp - 0x5c]
call fcn.00404350
push eax
lea ecx, [ebp - 0x5c]
call fcn.004047a0
push eax
lea edx, [ebp - 0x414]
push edx
call fcn.00414a70
add esp, 0xc
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x414]
call fcn.00404370
push eax
lea ecx, [ebp - 0x734]
call fcn.004133f0
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x414]
call fcn.00404510
jmp 0x42d513
push str.TAInstall::OperateUninstallReg_ProxyVersion_is_null_
push 5
push 0x4981a8
call fcn.0040ee50
add esp, 0xc
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x5c]
call fcn.00404920
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x44]
call fcn.00404510
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x734]
call fcn.00413120
push str.InstParams
lea ecx, [ebp - 0x45c]
call fcn.00404640
mov byte [ebp - 4], 0x54
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallTrustAgent
lea ecx, [ebp - 0x444]
call fcn.00404640
mov byte [ebp - 4], 0x55
push str.HKEY_LOCAL_MACHINE
lea ecx, [ebp - 0x42c]
call fcn.00404640
mov byte [ebp - 4], 0x56
push 0
lea eax, [ebp - 0x45c]
push eax
lea ecx, [ebp - 0x444]
push ecx
lea edx, [ebp - 0x42c]
push edx
lea ecx, [ebp - 0x76c]
call fcn.00413080
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x42c]
call fcn.00404510
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x444]
call fcn.00404510
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x45c]
call fcn.00404510
mov ecx, dword [ebp - 0x10]
add ecx, 0x34
call fcn.00404370
push eax
lea ecx, [ebp - 0x76c]
call fcn.004133f0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x76c]
call fcn.00413120
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x7d]
test ecx, ecx
je 0x42d73d
push 0x488a50
lea ecx, [ebp - 0x4a4]
call fcn.00404640
mov byte [ebp - 4], 0x5b
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x48c]
call fcn.00404640
mov byte [ebp - 4], 0x5c
push str.HKEY_CURRENT_USER
lea ecx, [ebp - 0x474]
call fcn.00404640
mov byte [ebp - 4], 0x5d
push 0
lea edx, [ebp - 0x4a4]
push edx
lea eax, [ebp - 0x48c]
push eax
lea ecx, [ebp - 0x474]
push ecx
lea ecx, [ebp - 0x7a4]
call fcn.00413080
mov byte [ebp - 4], 0x5f
lea ecx, [ebp - 0x474]
call fcn.00404510
mov byte [ebp - 4], 0x60
lea ecx, [ebp - 0x48c]
call fcn.00404510
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x4a4]
call fcn.00404510
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
push 0x488b0c
lea eax, [ebp - 0x53c]
push eax
call fcn.0042f270
add esp, 0xc
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov byte [ebp - 4], 0x62
push 0x488aec
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 0x524]
push eax
call fcn.0040b2c0
add esp, 0xc
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 4], 0x63
push 0x488ae8
mov edx, dword [ebp - 0x2c]
push edx
lea eax, [ebp - 0x4bc]
push eax
call fcn.0040b2c0
add esp, 0xc
mov byte [ebp - 4], 0x65
lea ecx, [ebp - 0x524]
call fcn.00404510
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x53c]
call fcn.00404510
lea ecx, [ebp - 0x4bc]
call fcn.00404370
push eax
lea ecx, [ebp - 0x7a4]
call fcn.004133f0
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x4bc]
call fcn.00404510
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x7a4]
call fcn.00413120
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7dc]
call fcn.00413120
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret