Function at 0x415040
Capabilities:
Create directory
Create process on windows
Create thread
Delete directory
Delete file
Get session user name
Print debug messages
Read .ini file
Self delete

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1bd4
call fcn.0042cd90
mov eax, dword [0x44a044]
xor eax, esp
mov dword [esp + 0x1bd0], eax
push ebx
push esi
push edi
push 0x220
push 0
push 0x479b20
call fcn.00427f40
add esp, 0xc
push 0x44b964
push 0x48e4f0
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x48e4ec], eax
mov eax, dword [ebp + 0x10]
mov edx, 0x48cb90
sub edx, eax
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4150a0
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push str.C:TempwmcInst.ini
push 0
push str.Time
push 0x442a50
call esi
push str.C:TempwmcInst.ini
push 0
push 0x442a5c
push 0x442a50
mov dword [0x489a88], eax
call esi
mov dword [0x489a8c], eax
mov eax, dword [ebp + 8]
mov dword [0x48aee8], eax
mov eax, 0x48cb90
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4150f5
sub eax, edx
sar eax, 1
je 0x41573c
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str._ManualUpdate__Elevate_CmdLine_
call edi
mov esi, 0x48cb90
call fcn.0040d0a0
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0xb7a]
push edx
mov dword [esp + 0x1c], 0
mov word [esp + 0xb7c], cx
call fcn.00427f40
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0xb70]
push str._C:Program_FilesWW2017CFwmcSystem7.exe___ap
push eax
call ebx
push str._apmode2
call fcn.00403ca0
add esp, 0xc
cmp eax, 1
jne 0x4151c4
lea ecx, [esp + 0xb70]
push ecx
lea ecx, [esp + 0x14]
call fcn.00405ee0
mov edx, dword [esp + 0x14]
add esp, 4
push edx
push eax
lea eax, [esp + 0xb78]
push eax
push 0x442b20
push 0x48d198
call ebx
add esp, 0x14
push 0x48d198
call edi
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1bd0]
xor ecx, esp
call fcn.00421294
mov esp, ebp
pop ebp
ret 0x10
push str._apmode3
call fcn.00403ca0
add esp, 4
cmp eax, 1
jne 0x4151ff
lea ecx, [esp + 0xb70]
push ecx
lea ecx, [esp + 0x14]
call fcn.00406370
mov edx, dword [esp + 0x14]
add esp, 4
push edx
push eax
lea eax, [esp + 0xb78]
push eax
push 0x442b80
jmp 0x415197
push str._apmode4
call fcn.00403ca0
add esp, 4
cmp eax, 1
jne 0x41523d
lea ecx, [esp + 0xb70]
push ecx
lea ecx, [esp + 0x14]
call fcn.00406370
mov edx, dword [esp + 0x14]
add esp, 4
push edx
push eax
lea eax, [esp + 0xb78]
push eax
push 0x442be0
jmp 0x415197
push str._apmode1
call fcn.00403ca0
add esp, 4
cmp eax, 1
jne 0x4152ed
push 0x44
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.00427f40
add esp, 0xc
xor eax, eax
lea edx, [esp + 0x60]
push edx
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [esp + 0xb90]
push ecx
push 0
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [esp + 0x68]
mov esi, eax
mov eax, dword [esp + 0x64]
test eax, eax
je 0x4152bf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x60]
test eax, eax
je 0x4152ce
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push esi
lea edx, [esp + 0xb78]
push edx
push 0x442c40
push 0x48d198
call dword [sym.imp.USER32.dll_wsprintfW]
jmp 0x41519e
push str._unrar
call fcn.00403ca0
add esp, 4
cmp eax, 1
jne 0x415442
cmp dword [0x489a94], 0
jne 0x415442
push str.wmcInst.exe_Command_to_Write_Package_File.
call edi
call fcn.00402060
mov ecx, eax
or ecx, edx
mov dword [0x48e6f8], eax
mov dword [0x48e6fc], edx
jne 0x415345
push 0x10
push 0x43adfc
push str._qL_eQ
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x416d31
mov edx, dword [0x48e700]
lea esi, [eax + edx + 0x10]
xor eax, eax
mov ecx, 0x36
lea edi, [esp + 0x70]
rep movsd dword es:[edi], dword [esi]
push 0x206
push eax
lea ecx, [esp + 0x76a]
push ecx
mov word [esp + 0x76c], ax
call fcn.00427f40
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x152]
push eax
mov word [esp + 0x154], dx
call fcn.00427f40
add esp, 0xc
push 0x104
lea ecx, [esp + 0x764]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x760]
push 0x5c
push edx
call fcn.00421cfc
add esp, 8
test eax, eax
je 0x4153dc
lea eax, [esp + 0x760]
push 0x5c
push eax
call fcn.00421cfc
add esp, 8
xor ecx, ecx
mov word [eax], cx
xor esi, esi
lea edi, [esp + 0x70]
cmp dword [edi], 0
je 0x415425
mov edx, dword [esi*4 + 0x44c414]
push edx
lea eax, [esp + 0x764]
push eax
lea ecx, [esp + 0x150]
push str._ls_s
push ecx
call ebx
mov edx, dword [0x48e6fc]
mov eax, dword [0x48e6f8]
push edx
push eax
lea ecx, [esp + 0x160]
push ecx
mov ecx, esi
call fcn.004024f0
add esp, 0x1c
inc esi
add edi, 0x18
cmp esi, 9
jl 0x4153e2
mov edx, dword [0x48e700]
push edx
call fcn.004212a3
add esp, 4
jmp 0x4151a8
push str._add
call fcn.00403ca0
add esp, 4
cmp eax, 1
jne 0x4156a5
cmp dword [0x489a94], 0
jne 0x4156a5
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x152]
push ecx
mov word [esp + 0x154], ax
call fcn.00427f40
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0xd82]
push eax
mov word [esp + 0xd84], dx
call fcn.00427f40
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x562]
push edx
mov word [esp + 0x564], cx
call fcn.00427f40
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x76a]
push ecx
mov word [esp + 0x76c], ax
call fcn.00427f40
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x35a]
push eax
mov word [esp + 0x35c], dx
call fcn.00427f40
add esp, 0xc
push 0x104
lea ecx, [esp + 0x14c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x148]
mov word [esp + eax + 0xd78], cx
add eax, 2
test cx, cx
jne 0x415520
lea edx, [esp + 0xd78]
push 0x5c
push edx
call fcn.00421cfc
add esp, 8
test eax, eax
je 0x415565
lea eax, [esp + 0xd78]
push 0x5c
push eax
call fcn.00421cfc
add esp, 8
xor ecx, ecx
mov word [eax], cx
xor eax, eax
jmp 0x415570
movzx ecx, word [esp + eax + 0xd78]
mov word [esp + eax + 0x760], cx
add eax, 2
test cx, cx
jne 0x415570
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [esp + eax + 0xd78]
mov word [esp + eax + 0x350], cx
add eax, 2
test cx, cx
jne 0x415590
lea edx, [esp + 0x760]
push 0x5c
push edx
call fcn.00421cfc
add eax, 2
lea edx, [esp + 0x560]
add esp, 8
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4155c6
lea eax, [esp + 0x558]
push 0x28
push eax
call fcn.00421cfc
add esp, 8
test eax, eax
je 0x415616
push 4
push 0x442d20
push eax
call fcn.00423ea6
add esp, 0xc
test eax, eax
jne 0x415616
lea ecx, [esp + 0x558]
push 0x28
push ecx
call fcn.00421cfc
add esp, 8
xor edx, edx
mov word [eax], dx
lea eax, [esp + 0x350]
push 0x5c
push eax
call fcn.00421cfc
add esp, 8
test eax, eax
je 0x415643
lea ecx, [esp + 0x350]
push 0x5c
push ecx
call fcn.00421cfc
add esp, 8
xor edx, edx
mov word [eax], dx
lea eax, [esp + 0x558]
push eax
lea ecx, [esp + 0x354]
push ecx
lea edx, [esp + 0x768]
push str._s_s.exe
push edx
call ebx
add esp, 0x10
lea esi, [esp + 0x760]
lea eax, [esp + 0x148]
call fcn.0040d020
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
push eax
call fcn.00402940
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1bd0]
xor ecx, esp
call fcn.00421294
mov esp, ebp
pop ebp
ret 0x10
push str._rar
call fcn.00403ca0
add esp, 4
cmp eax, 1
jne 0x4156dc
cmp dword [0x489a94], 0
jne 0x4156dc
call fcn.00401420
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1bd0]
xor ecx, esp
call fcn.00421294
mov esp, ebp
pop ebp
ret 0x10
push str._SmrInstallTerminate_
call fcn.00403ca0
add esp, 4
cmp eax, 1
jne 0x41570a
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str._wmcInst___Install_terminate___Clear_Temp_
call edi
call fcn.004120a0
jmp 0x4151a8
push str._SmrInstallSuccess_
call fcn.00403ca0
add esp, 4
cmp eax, 1
jne 0x416d31
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str._wmcInst__Install_Success__Clear_Temp_
call edi
call fcn.004120a0
jmp 0x4151a8
call fcn.00402060
mov dword [0x48e6f8], eax
mov dword [0x48e6fc], edx
test edx, edx
jne 0x415754
test eax, eax
je 0x41576a
mov ecx, dword [0x48e700]
lea esi, [eax + ecx + 0x10]
mov ecx, 0x36
mov edi, 0x48e708
rep movsd dword es:[edi], dword [esi]
call fcn.00413f30
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x139a]
push eax
mov word [esp + 0x139c], dx
call fcn.00427f40
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [esp + 0x1390]
push str.C:UsersPublicSMR7
push ecx
call ebx
mov esi, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
add esp, 8
push 0
lea edx, [esp + 0x1394]
push edx
push 0
call esi
call fcn.004120d0
test eax, eax
jne 0x4158c8
push 0x206
push eax
lea ecx, [esp + 0x152]
push ecx
mov word [esp + 0x154], ax
call fcn.00427f40
add esp, 0xc
lea edx, [esp + 0x148]
push str.C:UsersPublicSMR7DebugInitialFailLog
push edx
call ebx
add esp, 8
push 0
lea eax, [esp + 0x14c]
push eax
push 0
call esi
lea ecx, [esp + 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x35a]
push eax
mov word [esp + 0x35c], dx
call fcn.00427f40
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x562]
push edx
mov word [esp + 0x564], cx
call fcn.00427f40
add esp, 0xc
push 0x104
lea eax, [esp + 0x354]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx ecx, word [esp + 0x66]
movzx edx, word [esp + 0x62]
movzx eax, word [esp + 0x60]
push ecx
push edx
push eax
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x360]
push edx
lea eax, [esp + 0x56c]
push str._c_echo____date_____time_____s___Initial_Path_Fail________sFailLog__04u__02u__02u.log_
push eax
call ebx
add esp, 0x1c
push 5
push 0
lea ecx, [esp + 0x560]
push ecx
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x416d31
call fcn.004126c0
test eax, eax
jne 0x4159ba
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x152]
push eax
mov word [esp + 0x154], dx
call fcn.00427f40
add esp, 0xc
lea ecx, [esp + 0x148]
push str.C:UsersPublicSMR7DebugInitialFailLog
push ecx
call ebx
add esp, 8
push 0
lea edx, [esp + 0x14c]
push edx
push 0
call esi
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x35a]
push edx
mov word [esp + 0x35c], cx
call fcn.00427f40
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x562]
push ecx
mov word [esp + 0x564], ax
call fcn.00427f40
add esp, 0xc
push 0x104
lea edx, [esp + 0x354]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx eax, word [esp + 0x66]
movzx ecx, word [esp + 0x62]
movzx edx, word [esp + 0x60]
push eax
push ecx
push edx
lea eax, [esp + 0x154]
push eax
lea ecx, [esp + 0x360]
push ecx
lea edx, [esp + 0x56c]
push str._c_echo____date_____time_____s___Test_Write_Log_Fail________sFailLog__04u__02u__02u.log_
push edx
call ebx
add esp, 0x1c
push 5
push 0
lea eax, [esp + 0x560]
push eax
jmp 0x4158a6
push str.GlobalwmcInst.exe
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x48e6f4], eax
test eax, eax
jne 0x416d0c
push str.GlobalwmcInst.exe
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x48e6f4], eax
test eax, eax
jne 0x415a23
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x48e4ec]
push eax
push ecx
push 0x48e4f0
push 0x443018
push 0x48d198
call ebx
add esp, 0x14
push 0x48d198
call fcn.00406870
add esp, 4
jmp 0x416d31
mov edx, dword [0x48e4ec]
push edx
push 0x48e4f0
push 0x443078
push 0x48d198
call ebx
push 0x48d198
call fcn.00406870
add esp, 0x14
call fcn.00414c40
test eax, eax
je 0x415a73
push eax
push 0x4430e8
push 0x48d198
call ebx
add esp, 0xc
push 0x48d198
call fcn.00406870
add esp, 4
jmp 0x416d31
cmp dword [0x48e6fc], 0
ja 0x415a89
cmp dword [0x48e6f8], 0
jbe 0x415b9a
xor eax, eax
push 0x63e
push eax
lea ecx, [esp + 0x15a2]
push ecx
mov word [esp + 0x15a4], ax
call fcn.00427f40
mov eax, 0x48e708
add esp, 0xc
mov dword [esp + 0x10], 0x44c414
mov dword [esp + 0x14], eax
cmp dword [eax], 0
jbe 0x415b4e
lea edi, [esp + 0x1598]
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x415ad0
mov edx, dword [0x443114]
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [edi], edx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x415af0
lea edi, [esp + 0x1598]
sub eax, edx
add edi, 0xfffffffe
jmp 0x415b10
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x415b10
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1598]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x415b36
mov ecx, dword [0x443118]
mov eax, dword [esp + 0x14]
mov dword [edi], ecx
add dword [esp + 0x10], 4
add eax, 0x18
mov dword [esp + 0x14], eax
cmp eax, 0x48e7e0
jl 0x415aba
mov eax, dword [0x48e700]
mov ecx, dword [0x48e6fc]
lea edx, [esp + 0x1598]
push edx
mov edx, dword [0x48e6f8]
push eax
push ecx
push edx
push str.L_eQ_n
push 0x48d198
call ebx
push 0x48d198
call fcn.00406870
add esp, 0x1c
call fcn.00413360
push 0x443184
mov word [0x48496c], ax
call fcn.00406b20
add esp, 4
cmp dword [0x489a8c], 0
je 0x415c47
mov eax, dword [0x487438]
mov ecx, dword [0x487434]
mov edx, dword [0x487450]
push 0x4861c0
push 0x4861a0
push eax
mov eax, dword [0x48744c]
push ecx
mov ecx, dword [0x487430]
push edx
mov edx, dword [0x48742c]
push eax
mov eax, dword [0x44b62c]
push ecx
mov ecx, dword [0x487428]
push edx
mov edx, dword [0x487424]
push eax
mov eax, dword [0x487420]
push ecx
mov ecx, dword [0x48741c]
push edx
mov edx, dword [0x487418]
push eax
mov eax, dword [0x44b3a4]
push ecx
push edx
push eax
push 0x484954
push 0x485580
push 0x484b78
push str._b_tg_
push 0x48d198
call ebx
push 0x48d198
call fcn.00406870
add esp, 0x54
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0xf8a]
push edx
mov word [esp + 0xf8c], cx
call fcn.00427f40
add esp, 0xc
cmp word [0x48496c], 2
jne 0x415c8f
cmp dword [0x48e780], 0
jbe 0x415c8f
mov eax, dword [str.run1.exe]
push eax
push str.C:UsersPublicSMR7_s
lea ecx, [esp + 0xf88]
push ecx
jmp 0x415ca1
push 0x48bf60
push str._s_run1.exe
lea edx, [esp + 0xf88]
push edx
call ebx
add esp, 0xc
lea eax, [esp + 0xf80]
push 0
push eax
call fcn.00422010
add esp, 8
test eax, eax
jne 0x415cf4
lea ecx, [esp + 0xf80]
push ecx
push 0x443310
push 0x48d198
call ebx
add esp, 0xc
push 0x48d198
call fcn.00406870
add esp, 4
push 0x927c0
lea esi, [esp + 0xf84]
call fcn.0040d610
add esp, 4
push 0x443328
call fcn.00406b20
add esp, 4
push 0x48aef0
push 0x20000000
push 0
push 0x414880
push 0
push 0
call fcn.00424009
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
add esp, 0x18
cmp dword [0x489a7c], esi
jne 0x415d46
mov edi, edi
cmp esi, 0x258
je 0x415d46
push 0xa
call edi
inc esi
cmp dword [0x489a7c], 0
je 0x415d30
mov ax, word [0x48496c]
cmp ax, 9
jne 0x415db2
mov edx, dword [0x48aeec]
push 0
push 0x64
push 0x402
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x443338
call fcn.00406870
mov esi, 0x40010
mov edi, 0x43adfc
mov ebx, 0x443348
add esp, 4
push 0x493e0
call fcn.0040d4d0
add esp, 4
push 0
call fcn.00416d50
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1bd0]
xor ecx, esp
call fcn.00421294
mov esp, ebp
pop ebp
ret 0x10
test ax, ax
je 0x415dcd
push 0x484b78
push 0x443368
push 0x48d198
call ebx
add esp, 0xc
jmp 0x415ddc
push 0x443388
push 0x48d198
call ebx
add esp, 8
push 0x48d198
call fcn.00406870
mov eax, dword [0x48aeec]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 4
push 0
push 1
push 0x402
push eax
call esi
push 0x4433a4
call fcn.00406870
add esp, 4
call fcn.004139d0
push 0
test eax, eax
jne 0x415e46
mov ecx, dword [0x48aeec]
push 0x64
push 0x402
push ecx
call esi
push 0x4433d4
call fcn.00406870
mov esi, 0x40000
mov edi, str.P_g
mov ebx, str._rN_bT2
jmp 0x415d81
mov edx, dword [0x48aeec]
push 0x14
push 0x402
push edx
call esi
push 0x443468
call fcn.00406b20
mov ax, word [0x48496c]
add esp, 4
test ax, ax
jne 0x415e72
push 1
jmp 0x415e94
cmp ax, 1
jne 0x415e7c
push 3
jmp 0x415e94
cmp ax, 2
jne 0x415e86
push 3
jmp 0x415e94
cmp ax, 3
je 0x415e92
cmp ax, 4
jne 0x415e9c
push 2
call fcn.00414f00
add esp, 4
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x972]
push ecx
mov word [esp + 0x974], ax
call fcn.00427f40
add esp, 0xc
cmp word [0x48496c], 2
jne 0x415ee5
cmp dword [0x48e798], 0
jbe 0x415ee5
mov edx, dword [str.run2.exe]
push edx
push str.C:UsersPublicSMR7_s
lea eax, [esp + 0x970]
push eax
jmp 0x415ef7
push 0x48bf60
push str._s_run2.exe
lea ecx, [esp + 0x970]
push ecx
call ebx
add esp, 0xc
lea edx, [esp + 0x968]
push 0
push edx
call fcn.00422010
add esp, 8
test eax, eax
jne 0x415f4a
lea eax, [esp + 0x968]
push eax
push 0x443494
push 0x48d198
call ebx
add esp, 0xc
push 0x48d198
call fcn.00406870
add esp, 4
push 0x927c0
lea esi, [esp + 0x96c]
call fcn.0040d610
add esp, 4
push 0x4434ac
call fcn.00406b20
add esp, 4
cmp word [0x48496c], 2
jne 0x415f80
cmp dword [0x48e7b0], 0
jbe 0x415f80
mov ecx, dword [str.rms.exe]
push ecx
push str.C:UsersPublicSMR7_s
lea edx, [esp + 0x970]
push edx
jmp 0x415f92
push 0x48bf60
push 0x4434bc
lea eax, [esp + 0x970]
push eax
call ebx
add esp, 0xc
lea ecx, [esp + 0x968]
push 0
push ecx
call fcn.00422010
add esp, 8
test eax, eax
jne 0x416006
lea edx, [esp + 0x968]
push edx
push 0x4434d4
push 0x48d198
call ebx
add esp, 0xc
push 0x48d198
call fcn.00406870
add esp, 4
push 0x1b7740
lea esi, [esp + 0x96c]
call fcn.0040d610
add esp, 4
push 0x4434f8
mov dword [0x48e3e0], 1
mov dword [0x489a78], 0
call fcn.00406870
add esp, 4
push 0x443524
call fcn.00406b20
add esp, 4
call fcn.00413e10
test eax, eax
jne 0x41605b
push eax
mov eax, dword [0x48aeec]
push 0x64
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x443538
call fcn.00406870
add esp, 4
call fcn.00415000
push 0xdbba0
mov esi, 0x40040
mov edi, 0x44357c
mov ebx, str.uP_n0R
jmp 0x415d89
push 0x4435c8
call fcn.00406b20
add esp, 4
push 0x4435e0
call fcn.00406870
add esp, 4
cmp word [0x48496c], 2
jne 0x416174
mov ecx, dword [0x48e6fc]
mov edx, dword [0x48e6f8]
push ecx
push edx
push str.C:UsersPublicSMR7WM7ClientPackage.cab
xor ecx, ecx
call fcn.004024f0
add esp, 0xc
push 0x4436a8
call fcn.00406b20
add esp, 4
cmp word [0x48496c], 0
je 0x4160c3
call fcn.00412bb0
push 0x3e8
call edi
push 0x4436b4
call fcn.00406b20
add esp, 4
cmp dword [0x487444], 0
jne 0x416124
mov esi, 0x43ad88
mov edi, edi
mov edx, dword [esi]
mov ecx, str.C:UsersPublicSMR7WM7installTemp_
call fcn.0040e520
test eax, eax
jne 0x416119
mov ecx, dword [esi]
push ecx
push 0x44370c
push 0x48d198
call ebx
add esp, 0xc
push 0x48d198
call fcn.00406870
add esp, 4
mov dword [0x44b6ac], 0
add esi, 4
cmp esi, 0x43ada4
jl 0x4160e0
cmp word [0x48496c], 0
jne 0x4161f1
mov eax, 0x484954
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416140
sub eax, edx
sar eax, 1
cmp eax, 9
je 0x4161f1
push 0x443728
call fcn.00406870
add esp, 4
mov dword [0x44b6ac], 0
jmp 0x4161fa
mov esi, str.C:UsersPublicSMR7WM7ClientPackage.cab
mov eax, 0x484970
call fcn.0040d020
push 0x3e8
call edi
push 0
push esi
call fcn.00422010
add esp, 8
test eax, eax
je 0x4160a0
push 0x484970
push 0x443610
push 0x48d198
call ebx
add esp, 0xc
push 0x48d198
call fcn.00406870
mov eax, dword [0x48aeec]
add esp, 4
push 0
push 0x64
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.00415000
push 0xdbba0
mov esi, 0x40010
mov edi, str.pu8
mov ebx, 0x443650
jmp 0x415d89
cmp dword [0x44b6ac], 0
jne 0x41623b
mov edx, dword [0x48aeec]
push 0
push 0x64
push 0x402
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x443750
call fcn.00406870
add esp, 4
call fcn.00415000
push 0xdbba0
mov esi, 0x40010
mov edi, str.pu8
mov ebx, 0x443780
jmp 0x415d89
push 0x4437e4
call fcn.00406870
add esp, 4
push 0x4437f4
call fcn.00406b20
add esp, 4
cmp dword [0x487438], 1
jne 0x4162b0
push 0x443808
call fcn.00406870
add esp, 4
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x152]
push ecx
mov word [esp + 0x154], ax
call fcn.00427f40
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea edx, [esp + 0x14c]
push str._sWM7F.cab
push edx
call ebx
add esp, 0xc
lea eax, [esp + 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [0x48e738], 0
jbe 0x416334
cmp word [0x48496c], 2
jne 0x416334
push 0
push 0x489ea8
call fcn.00421f91
mov edi, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
add esp, 8
test eax, eax
je 0x4162e7
push 0
push 0x489ea8
push 0
call edi
mov ecx, dword [0x48e6fc]
mov edx, dword [0x48e6f8]
push ecx
push edx
push 0x489ca0
mov ecx, 2
call fcn.004024f0
add esp, 0xc
push 0x489ca0
push 0x443850
push 0x48d198
call ebx
add esp, 0xc
push 0x48d198
call fcn.00406870
mov dword [0x489a80], 1
jmp 0x4163db
push 0
push 0x489a98
call fcn.00422010
add esp, 8
test eax, eax
jne 0x4163c1
push eax
push 0x489ea8
call fcn.00421f91
mov edi, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
add esp, 8
test eax, eax
je 0x41636a
push 0
push 0x489ea8
push 0
call edi
mov esi, 0x489ca0
mov eax, 0x489a98
call fcn.0040d020
mov ax, word [0x48496c]
cmp ax, 1
jne 0x416391
push 0x489a98
push 0x443874
jmp 0x4163a1
cmp ax, 2
jbe 0x4163ab
push 0x489a98
push 0x44389c
push 0x48d198
call ebx
add esp, 0xc
push 0x48d198
call fcn.00406870
mov dword [0x489a80], 1
jmp 0x4163db
push 0x4438c0
call fcn.00406870
mov edi, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov dword [0x489a80], 0
add esp, 4
push 0x4438d4
call fcn.00406b20
add esp, 4
cmp dword [0x48e750], 0
jbe 0x416459
cmp word [0x48496c], 2
jne 0x416459
push 0
push 0x48a4c0
call fcn.00421f91
add esp, 8
test eax, eax
je 0x41641c
push 0
push 0x48a4c0
push 0
call edi
mov eax, dword [0x48e6fc]
mov ecx, dword [0x48e6f8]
push eax
push ecx
push 0x48a2b8
mov ecx, 3
call fcn.004024f0
add esp, 0xc
push 0x48a2b8
push 0x4438e8
push 0x48d198
call ebx
add esp, 0xc
push 0x48d198
jmp 0x4164e5
push 0
push 0x48a0b0
call fcn.00422010
add esp, 8
test eax, eax
jne 0x4164e0
push eax
push 0x48a4c0
call fcn.00421f91
add esp, 8
test eax, eax
je 0x416489
push 0
push 0x48a4c0
push 0
call edi
mov esi, 0x48a2b8
mov eax, 0x48a0b0
call fcn.0040d020
mov ax, word [0x48496c]
cmp ax, 1
jne 0x4164bf
push 0x48a0b0
push 0x44390c
push 0x48d198
call ebx
add esp, 0xc
push 0x48d198
jmp 0x4164e5
cmp ax, 2
jbe 0x4164d9
push 0x48a0b0
push 0x443934
push 0x48d198
call ebx
add esp, 0xc
push 0x48d198
jmp 0x4164e5
push 0x443958
call fcn.00406870
add esp, 4
push 0x44396c
call fcn.00406b20
add esp, 4
cmp dword [0x48e768], 0
jbe 0x416568
cmp word [0x48496c], 2
jne 0x416568
push 0
push 0x48aad8
call fcn.00421f91
add esp, 8
test eax, eax
je 0x41652b
push 0
push 0x48aad8
push 0
call edi
mov edx, dword [0x48e6fc]
mov eax, dword [0x48e6f8]
push edx
push eax
push 0x48a8d0
mov ecx, 4
call fcn.004024f0
add esp, 0xc
push 0x48a8d0
push 0x443984
push 0x48d198
call ebx
add esp, 0xc
push 0x48d198
jmp 0x4165f4
push 0
push 0x48a6c8
call fcn.00422010
add esp, 8
test eax, eax
jne 0x4165ef
push eax
push 0x48aad8
call fcn.00421f91
add esp, 8
test eax, eax
je 0x416598
push 0
push 0x48aad8
push 0
call edi
mov esi, 0x48a8d0
mov eax, 0x48a6c8
call fcn.0040d020
mov ax, word [0x48496c]
cmp ax, 1
jne 0x4165ce
push 0x48a6c8
push 0x4439b8
push 0x48d198
call ebx
add esp, 0xc
push 0x48d198
jmp 0x4165f4
cmp ax, 2
jbe 0x4165e8
push 0x48a6c8
push 0x4439f0
push 0x48d198
call ebx
add esp, 0xc
push 0x48d198
jmp 0x4165f4
push 0x443a24
call fcn.00406870
add esp, 4
push 0x443a44
call fcn.00406b20
add esp, 4
push 0x443a68
call fcn.00406870
add esp, 4
call fcn.00413c30
push 0x443a9c
call fcn.00406b20
mov ecx, dword [0x48aeec]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 4
push 0
push 0x19
push 0x402
push ecx
call edi
mov esi, 1
cmp dword [0x48786c], esi
jne 0x416671
mov eax, 0x488870
call fcn.0040ecd0
push 0x443ad0
call fcn.00406870
add esp, 4
push 0x443ae8
call fcn.00406b20
add esp, 4
call fcn.00414af0
cmp dword [0x489a78], esi
jne 0x4166f4
push 0x443b08
call fcn.00406870
add esp, 4
call fcn.0040cfa0
call fcn.004128b0
test al, al
jne 0x4166da
mov edx, dword [0x48aeec]
push 0
push 0x64
push 0x402
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x443b40
call fcn.00406870
add esp, 4
call fcn.00415000
push 0xdbba0
mov esi, 0x40010
mov edi, str.P_g
mov ebx, 0x443b70
jmp 0x415d89
push 0x443bcc
call fcn.00406870
add esp, 4
push 0x443be4
call fcn.00406b20
add esp, 4
mov eax, dword [0x48aeec]
push 0
push 0x32
push 0x402
push eax
call edi
call fcn.00419fe0
call fcn.00403b50
test eax, eax
je 0x416718
call fcn.0041a640
push 0x443c04
call fcn.00406b20
add esp, 4
push 0x443c14
call fcn.00406870
add esp, 4
call fcn.00417040
push 0x443c2c
call fcn.00406b20
mov eax, dword [0x487448]
add esp, 4
test eax, eax
je 0x416784
push eax
push 0x443c40
push 0x48d198
call ebx
add esp, 0xc
push 0x48d198
call fcn.00406870
mov ecx, dword [0x487448]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Delay_End
call fcn.00406870
add esp, 4
push 0x443c8c
call fcn.00406870
add esp, 4
call fcn.00411800
mov edx, dword [0x48aeec]
push 0
push 0x4e
push 0x402
push edx
mov esi, eax
call edi
push str.SetupClient
call fcn.00406b20
add esp, 4
call fcn.00405da0
test eax, eax
jne 0x4167dd
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.uP_nw
call fcn.00406870
add esp, 4
call fcn.0040b870
push 0
push 0
push str.C:UsersPublicSMR7WM7installTemp
call fcn.004084d0
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push str.C:UsersPublicSMR7WM7ClientPackage.cab
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x443d18
call fcn.00406870
mov eax, dword [0x48aeec]
add esp, 4
push 0
push 0x50
push 0x402
push eax
call edi
push 0x443d28
call fcn.00406b20
add esp, 4
test esi, esi
jne 0x4168d3
push 0x443d38
call fcn.00406870
add esp, 4
call fcn.0040cfa0
mov ecx, dword [0x48aeec]
push esi
push 0x5a
push 0x402
push ecx
call edi
call fcn.0041b010
mov edx, dword [0x48aeec]
push esi
push 0x64
push 0x402
push edx
call edi
mov eax, dword [0x48aef0]
push esi
push esi
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
cmp dword [0x44b91c], 1
jne 0x416890
push 0x443d7c
jmp 0x416895
push 0x443db0
call fcn.00406870
add esp, 4
call fcn.004197b0
call fcn.00415000
push 0xdbba0
mov esi, 0x40010
mov edi, str.P_g
mov ebx, 0x443df8
call fcn.0040d4d0
add esp, 4
push 0
call fcn.00416d50
add esp, 4
push eax
call fcn.00423b69
mov esi, 1
cmp dword [0x489a78], esi
jne 0x416910
push 0x443e58
call fcn.00406870
add esp, 4
call fcn.00419430
push 0x443e70
call fcn.00406870
add esp, 4
call fcn.0040c350
push 0x443e8c
call fcn.00406b20
jmp 0x41691a
push 0x443ec0
call fcn.00406870
add esp, 4
push esi
call fcn.00418020
mov ecx, dword [0x48aeec]
add esp, 4
push 0
push 0x55
push 0x402
push ecx
call edi
push 0x443ed0
call fcn.00406b20
add esp, 4
push 0x443ee0
call fcn.00406870
add esp, 4
call fcn.00405750
test eax, eax
jne 0x416a9e
cmp dword [0x489a90], eax
jle 0x416a12
push str.uP_n_U
call fcn.00406870
add esp, 4
lea edi, [esp + 0x14]
mov dword [esp + 0x14], 0
call fcn.0040b710
mov edi, dword [esp + 0x14]
mov edx, dword [0x489a90]
push edi
mov esi, eax
push esi
push edx
push 0x443f08
push 0x48d198
call ebx
mov eax, dword [0x48aeec]
add esp, 0x14
push 0
push 0x64
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x48aef0]
push 0
push 0
push 0x12
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0x48d198
call fcn.00406870
mov edx, dword [0x489a90]
add esp, 4
push edi
push esi
push edx
push 0x443f68
push 0x48d198
call ebx
add esp, 0x14
call fcn.00415000
push 0xdbba0
mov esi, 0x40000
mov edi, 0x443f94
mov ebx, 0x48d198
jmp 0x4168bb
push 0x443f9c
call fcn.00406870
add esp, 4
call fcn.0040cfa0
mov eax, dword [0x48aeec]
push 0
push 0x5a
push 0x402
push eax
call edi
call fcn.0041b010
mov ecx, dword [0x48aeec]
push 0
push 0x64
push 0x402
push ecx
call edi
mov edx, dword [0x48aef0]
push 0
push 0
push 0x12
push edx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
cmp dword [0x44b91c], esi
jne 0x416a6e
push 0x443d7c
jmp 0x416a73
push 0x443db0
call fcn.00406870
add esp, 4
call fcn.004197b0
call fcn.00415000
push 0xdbba0
mov esi, 0x40010
mov edi, str.P_g
mov ebx, 0x443fc0
jmp 0x4168bb
cmp dword [0x489a90], 0
jle 0x416aee
push str.uP_n_
call fcn.00406870
add esp, 4
lea edi, [esp + 0x14]
mov dword [esp + 0x14], 0
call fcn.0040b710
mov ecx, dword [esp + 0x14]
mov edx, dword [0x489a90]
push ecx
push eax
push edx
push 0x444018
push 0x48d198
call ebx
add esp, 0x14
push 0x48d198
call fcn.00406870
add esp, 4
mov eax, dword [0x487440]
cmp eax, 1
jne 0x416b09
push 0
call fcn.00411250
add esp, 4
push 0x444058
jmp 0x416b1d
cmp eax, 2
jne 0x416b25
push 1
call fcn.00411250
add esp, 4
push 0x44406c
call fcn.00406b20
add esp, 4
cmp word [0x48496c], 3
jb 0x416b41
call fcn.004113b0
push 0x444080
call fcn.00406b20
add esp, 4
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1192]
push ecx
mov word [esp + 0x1194], ax
call fcn.00427f40
add esp, 0xc
cmp word [0x48496c], 2
jne 0x416b8a
cmp dword [0x48e7c8], 0
jbe 0x416b8a
mov edx, dword [str.run3.exe]
push edx
push str.C:UsersPublicSMR7_s
lea eax, [esp + 0x1190]
push eax
jmp 0x416b9c
push 0x48bf60
push str._s_run3.exe
lea ecx, [esp + 0x1190]
push ecx
call ebx
add esp, 0xc
lea edx, [esp + 0x1188]
push 0
push edx
call fcn.00422010
add esp, 8
test eax, eax
jne 0x416bef
lea eax, [esp + 0x1188]
push eax
push 0x4440b0
push 0x48d198
call ebx
add esp, 0xc
push 0x48d198
call fcn.00406870
add esp, 4
push 0x927c0
lea esi, [esp + 0x118c]
call fcn.0040d610
add esp, 4
push 0x4440cc
call fcn.00406b20
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
add esp, 4
cmp dword [0x44b3a4], eax
jne 0x416c76
cmp dword [0x487418], eax
jne 0x416c76
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x152]
push edx
mov word [esp + 0x154], cx
call fcn.00427f40
add esp, 0xc
push 0x48cf90
lea eax, [esp + 0x14c]
push str._spcinfo7.exe
push eax
call ebx
add esp, 0xc
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x48cf90
push 0x43c324
lea ecx, [esp + 0x154]
push ecx
push str.open
push 0
call esi
call fcn.004197b0
push 0
push 0x43c324
push 0x4440dc
push str.C:WindowsSysWOW64wmcUpdater.exe
push str.open
push 0
call esi
push 0
push 0x43c324
push 0x4440dc
push str.C:WindowsSystem32wmcUpdater.exe
push str.open
push 0
call esi
mov edx, dword [0x48aeec]
push 0
push 0x64
push 0x402
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x48aef0]
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0x444180
call fcn.00406870
add esp, 4
call fcn.00415000
push 0xdbba0
mov esi, 0x40000
mov edi, 0x443f94
mov ebx, 0x4441a8
call fcn.0040d4d0
add esp, 4
push 1
jmp 0x4168c5
mov ecx, dword [0x48e4ec]
push ecx
push 0x48e4f0
push str.__s___u_
push 0x48d198
call ebx
push 0x48d198
call fcn.00406870
add esp, 0x14
mov ecx, dword [esp + 0x1bdc]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00421294
mov esp, ebp
pop ebp
ret 0x10