Function at 0x42c3a0
Capabilities:
Check if file exists
Check os version
Contain obfuscated stackstrings
Delete directory
Delete file
Delete service
Get common file path
Move file
Parse pe header
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x45b041
push eax
mov eax, 0x10a28
mov dword fs:[0], esp
call fcn.00447a40
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
mov ecx, 0x47fe18
mov eax, dword [ebp + 8]
push 0
mov dword [esi + 0x1f0], eax
call fcn.0041c520
mov dword [esi + 0x278], 0
mov eax, dword [0x476478]
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x230], eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x238], SysReAllocString
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x22c], 0x100
mov dword [ebp - 0x224], 0
mov byte [ebp - 4], 2
lea ecx, [esi + 0x31c]
push 0xf003f
push 1
push ecx
mov eax, esp
mov dword [ebp - 0x3c], esp
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push eax
mov dword [ebp - 0x238], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc8], ecx
call fcn.00409520
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x23c]
call fcn.0042b170
mov eax, dword [0x476478]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ecx
mov esi, esp
mov dword [ebp - 0x3c], esp
mov ecx, 0x46155c
mov dword [esi], eax
mov eax, 0x46155c
shr eax, 0x10
mov dword [ebp - 0x20], eax
test ax, ax
jne 0x42c4b2
movzx eax, cx
mov ecx, esi
push eax
call fcn.0041c880
jmp 0x42c4e4
push 0x46155c
call edi
mov edi, eax
test edi, edi
je 0x42c4de
push edi
mov ecx, esi
call fcn.0040a900
test eax, eax
je 0x42c4de
lea eax, [edi + edi]
push eax
push 0x46155c
push dword [esi]
call fcn.004480a0
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov byte [ebp - 4], 4
mov eax, dword [0x476478]
push ecx
mov esi, esp
mov dword [ebp - 0x98], esp
mov ecx, str.InstallLocation
mov dword [esi], eax
mov eax, ecx
shr eax, 0x10
test eax, eax
jne 0x42c513
movzx eax, cx
mov ecx, esi
push eax
call fcn.0041c880
jmp 0x42c53f
push str.InstallLocation
call edi
mov edi, eax
test edi, edi
je 0x42c53f
push edi
mov ecx, esi
call fcn.0040a900
test eax, eax
je 0x42c53f
lea eax, [edi + edi]
push eax
push str.InstallLocation
push dword [esi]
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 5
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x23c]
call fcn.00427880
mov byte [ebp - 4], 6
mov esi, dword [ebp - 0x18]
push eax
lea ecx, [esi + 0x254]
call fcn.00408f00
mov byte [ebp - 4], 2
or edi, 0xffffffff
mov eax, dword [ebp - 0x28]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42c59b
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42c59b
mov eax, dword [ebp - 0x28]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov eax, dword [ebp + 0x14]
cmp dword [eax - 8], 0
je 0x42c5b3
lea eax, [ebp + 0x14]
push eax
lea ecx, [esi + 0x254]
call fcn.00408f00
push 0x11c
lea eax, [ebp - 0x468]
push 0
push eax
call fcn.004486f0
add esp, 0xc
mov dword [ebp - 0x468], 0x11c
lea eax, [ebp - 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push ecx
mov esi, esp
mov dword [ebp - 0x3c], esp
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x98], esp
push str.Deinstallation_gestartet
call fcn.004054c0
mov byte [ebp - 4], 7
push esi
mov byte [ebp - 4], 2
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 8
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
call fcn.00437830
mov esi, dword [ebp - 0x20]
mov eax, dword [0x476478]
push ecx
mov dword [ebp - 0x3c], esp
mov ecx, esp
mov dword [ebp - 0x28], ecx
mov dword [ecx], eax
test si, si
jne 0x42c644
mov eax, 0x46155c
movzx eax, ax
push eax
call fcn.0041c880
jmp 0x42c67b
push 0x46155c
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x42c67b
mov ecx, dword [ebp - 0x28]
push eax
call fcn.0040a900
test eax, eax
je 0x42c67b
mov eax, dword [ebp - 0x20]
add eax, eax
push eax
mov eax, dword [ebp - 0x28]
push 0x46155c
push dword [eax]
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 9
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
call fcn.00437830
mov eax, dword [0x476478]
mov edx, 0x4642c0
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
mov dword [ebp - 0x28], ecx
mov dword [ecx], eax
mov eax, edx
shr eax, 0x10
test eax, eax
jne 0x42c6b4
movzx eax, dx
push eax
call fcn.0041c880
jmp 0x42c6eb
push 0x4642c0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x42c6eb
mov ecx, dword [ebp - 0x28]
push eax
call fcn.0040a900
test eax, eax
je 0x42c6eb
mov eax, dword [ebp - 0x20]
add eax, eax
push eax
mov eax, dword [ebp - 0x28]
push 0x4642c0
push dword [eax]
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
call fcn.00437830
mov eax, dword [0x476478]
push ecx
mov dword [ebp - 0x3c], esp
mov ecx, esp
mov dword [ebp - 0x20], ecx
mov dword [ecx], eax
test si, si
jne 0x42c720
mov eax, 0x46155c
movzx eax, ax
push eax
call fcn.0041c880
jmp 0x42c756
push 0x46155c
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x42c756
mov esi, dword [ebp - 0x20]
mov ecx, esi
push eax
call fcn.0040a900
test eax, eax
je 0x42c756
mov eax, dword [ebp - 0x4c]
add eax, eax
push eax
push 0x46155c
push dword [esi]
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
call fcn.00437830
push ecx
mov esi, esp
mov dword [ebp - 0x3c], esp
push str._...
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x98], esp
push str.Aufr
call fcn.004054c0
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 2
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0xd
push eax
push esi
call fcn.00409410
mov byte [ebp - 4], 0xe
mov byte [ebp - 4], 0xd
mov esi, dword [ebp - 0x18]
mov ecx, esi
call fcn.00437830
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x28]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42c7e6
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42c7e6
mov eax, dword [ebp - 0x28]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
push 0x44
lea eax, [ebp - 0x2f4]
mov dword [ebp - 0x2a0], 0
push 0
push eax
call fcn.004486f0
mov eax, dword [esi + 0x24c]
add esi, 0x24c
xorps xmm0, xmm0
mov dword [ebp - 0x2f4], 0x44
add esp, 0xc
movdqu xmmword [ebp - 0x2b0], xmm0
cmp dword [eax - 8], 0
je 0x42c8dd
cmp dword [ebp + 8], 0
mov ecx, 0x46155c
mov eax, str.:uninstall
cmove eax, ecx
lea ecx, [ebp + 8]
push eax
call fcn.00405580
mov byte [ebp - 4], 0xf
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
push 0x46155c
call fcn.00405580
mov byte [ebp - 4], 0x10
push ecx
mov eax, esp
mov dword [ebp - 0x98], esp
lea ecx, [ebp + 8]
push ecx
push str.__cleanup
push eax
call fcn.00409520
mov byte [ebp - 4], 0x11
push ecx
mov ecx, esp
mov dword [ebp - 0x1d8], esp
push esi
call fcn.00405440
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x2f4]
call fcn.0040d280
mov eax, dword [ebp - 0x2b0]
test eax, eax
je 0x42c8b4
push 0x61a8
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42c8dd
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42c8dd
push ecx
call fcn.004471aa
add esp, 4
mov esi, dword [ebp - 0x18]
lea eax, [esi + 0x270]
mov dword [ebp - 0x1ec], eax
mov eax, dword [eax]
test eax, eax
jne 0x42c8fa
mov dword [ebp - 0x84], eax
jmp 0x42c903
mov eax, dword [eax + 4]
mov dword [ebp - 0x84], eax
push dword [esi + 0x298]
call dword [sym.imp.USER32.dll_IsWindow]
push dword [ebp - 0x84]
push 0
push 0x406
push dword [esi + 0x298]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [esi + 0x298]
call dword [sym.imp.USER32.dll_IsWindow]
push 0
push 0
push 0x402
push dword [esi + 0x298]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x84]
lea eax, [ecx - 1]
mov dword [ebp - 0x28], eax
test eax, eax
js 0x430346
mov edi, eax
nop
push dword [esi + 0x298]
call dword [sym.imp.USER32.dll_IsWindow]
mov eax, dword [ebp - 0x84]
push 0
sub eax, edi
dec eax
push eax
push 0x402
push dword [esi + 0x298]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x476478]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x90], eax
mov byte [ebp - 4], 0x13
mov esi, dword [0x476478]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x44], esi
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x1ec]
push edi
push eax
call fcn.0043ee30
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x10]
mov ecx, dword [0x476478]
mov dword [ebp - 0x24], ecx
test eax, eax
jne 0x42c9da
mov dword [ebp - 0xa0], ecx
jmp 0x42ca71
mov edx, dword [eax]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0xa0], ecx
test edx, edx
je 0x42ca71
mov eax, edx
shr eax, 0x10
test eax, eax
jne 0x42ca10
movzx eax, dx
lea ecx, [ebp - 0xa0]
push eax
call fcn.0041c880
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x24], eax
jmp 0x42ca71
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
mov dword [ebp + 8], edi
test edi, edi
je 0x42ca71
lea ecx, [edi*2 + 0x22]
push ecx
call fcn.004451f4
add esp, 4
test eax, eax
je 0x42ca71
xor ecx, ecx
mov dword [eax], 1
mov word [eax + edi*2 + 0x20], cx
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], edi
lea edi, [eax + 0x20]
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0x10], ecx
mov dword [ebp - 0xa0], edi
mov eax, dword [ebp + 8]
add eax, eax
mov dword [ebp - 0x24], edi
push eax
push dword [ebp - 0x14]
push edi
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42ca93
mov edi, dword [0x476478]
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xa8], edi
jmp 0x42cb7f
mov ecx, dword [eax + 0x10]
mov edi, dword [eax + 0x28]
mov dword [ebp + 8], 0
mov dword [ebp - 0x14], ecx
test ecx, ecx
jle 0x42cad2
jmp 0x42cab0
push str.InstallerArch
push dword [edi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42cb17
mov eax, dword [ebp + 8]
add edi, 8
inc eax
mov dword [ebp + 8], eax
cmp eax, dword [ebp - 0x14]
jl 0x42cab0
xor ecx, ecx
mov edi, dword [0x476478]
mov dword [ebp + 8], ecx
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xa8], edi
test ecx, ecx
je 0x42cb7f
mov eax, ecx
shr eax, 0x10
test eax, eax
jne 0x42cb1c
movzx eax, cx
lea ecx, [ebp - 0xa8]
push eax
call fcn.0041c880
mov edi, dword [ebp - 0xa8]
mov dword [ebp - 0xac], edi
jmp 0x42cb7f
mov ecx, dword [edi + 4]
jmp 0x42cad4
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x42cb7f
lea ecx, [eax*2 + 0x22]
push ecx
call fcn.004451f4
add esp, 4
test eax, eax
je 0x42cb7f
mov ecx, dword [ebp - 0x14]
lea edi, [eax + 0x20]
xor edx, edx
mov dword [eax], 1
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0xac], edi
mov word [eax + ecx*2 + 0x20], dx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0xc], edx
mov dword [eax + 8], edx
mov dword [eax + 4], edx
mov dword [eax + 0x10], edx
lea eax, [ecx + ecx]
push eax
push dword [ebp + 8]
push edi
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 0x17
cmp dword [edi - 8], 0
je 0x42cc18
push 0x463eec
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x42cc0c
mov byte [ebp - 4], 0x16
lea eax, [edi - 0x20]
cmp eax, dword [0x476474]
je 0x42cbc8
lea ecx, [edi - 0x20]
or edi, 0xffffffff
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42cbcb
push ecx
call fcn.004471aa
add esp, 4
jmp 0x42cbcb
or edi, 0xffffffff
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x24]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42cbf4
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42cbf4
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x14
push dword [ebp - 0x10]
call fcn.0043d220
add esp, 4
mov byte [ebp - 4], 0x13
jmp 0x4302e8
push 0x463ef4
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], 0
test eax, eax
je 0x42cc73
mov ecx, dword [eax + 0x10]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
mov dword [ebp + 8], eax
test ecx, ecx
jle 0x42cc6c
jmp 0x42cc40
push str.OnlyIfOS
push dword [eax]
call fcn.00446ab0
add esp, 8
test eax, eax
mov eax, dword [ebp + 8]
je 0x42ccdc
mov ecx, dword [ebp - 0x1c]
add eax, 8
inc ecx
mov dword [ebp + 8], eax
mov dword [ebp - 0x1c], ecx
cmp ecx, dword [ebp - 0x14]
jl 0x42cc40
mov dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp + 8], ecx
lea edx, [esi - 0x20]
mov eax, 1
mov dword [ebp - 0x14], edx
cmp dword [edx], eax
jg 0x42cc90
cmp ecx, dword [esi - 0xc]
jle 0x42cd45
add esi, 0xffffffe0
cmp esi, dword [0x476474]
je 0x42ccf4
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x42ccca
mov eax, dword [edx + 0x10]
test eax, eax
je 0x42ccc1
push eax
call fcn.00446dea
mov edx, dword [ebp - 0x14]
add esp, 4
mov dword [edx + 0x10], 0
push edx
call fcn.004471aa
add esp, 4
mov eax, dword [0x476478]
mov esi, eax
mov dword [ebp - 0x44], esi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x30], esi
jmp 0x42ccf9
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x42cc73
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
mov dword [ebp + 8], eax
jmp 0x42cc78
mov eax, dword [0x476478]
test ecx, ecx
jne 0x42cd01
mov esi, eax
jmp 0x42cd3a
lea eax, [ecx*2 + 0x22]
push eax
call fcn.004451f4
mov ecx, dword [ebp + 8]
add esp, 4
test eax, eax
je 0x42cd45
xor edx, edx
mov dword [eax], 1
mov word [eax + ecx*2 + 0x20], dx
lea esi, [eax + 0x20]
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0xc], edx
mov dword [eax + 8], edx
mov dword [eax + 4], edx
mov dword [eax + 0x10], edx
mov dword [ebp - 0x44], esi
mov eax, 1
mov dword [ebp - 0x30], esi
mov esi, dword [ebp - 0x30]
mov dword [esi - 0x14], 0
test eax, eax
je 0x42cd73
lea eax, [ecx + ecx]
push eax
push dword [ebp - 0x1c]
add eax, 2
push eax
push esi
call fcn.00445948
mov eax, dword [ebp + 8]
add esp, 0x10
xor ecx, ecx
mov dword [esi - 8], eax
mov word [esi + eax*2], cx
cmp dword [esi - 8], 0
je 0x42cdb9
push 0x463eec
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x42cd99
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x274], 1
jne 0x42cb9d
push 0x463ef4
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x42cdb9
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x274], 1
je 0x42cb9d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], 0
test eax, eax
je 0x42ce13
mov ecx, dword [eax + 0x10]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
mov dword [ebp + 8], eax
test ecx, ecx
jle 0x42ce0c
jmp 0x42cde0
push str.OSType
push dword [eax]
call fcn.00446ab0
add esp, 8
test eax, eax
mov eax, dword [ebp + 8]
je 0x42ce7c
mov ecx, dword [ebp - 0x1c]
add eax, 8
inc ecx
mov dword [ebp + 8], eax
mov dword [ebp - 0x1c], ecx
cmp ecx, dword [ebp - 0x14]
jl 0x42cde0
mov dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp + 8], ecx
lea edx, [esi - 0x20]
mov eax, 1
mov dword [ebp - 0x14], edx
cmp dword [edx], eax
jg 0x42ce30
cmp ecx, dword [esi - 0xc]
jle 0x42cee5
add esi, 0xffffffe0
cmp esi, dword [0x476474]
je 0x42ce94
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x42ce6a
mov eax, dword [edx + 0x10]
test eax, eax
je 0x42ce61
push eax
call fcn.00446dea
mov edx, dword [ebp - 0x14]
add esp, 4
mov dword [edx + 0x10], 0
push edx
call fcn.004471aa
add esp, 4
mov eax, dword [0x476478]
mov esi, eax
mov dword [ebp - 0x44], esi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x30], esi
jmp 0x42ce99
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x42ce13
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
mov dword [ebp + 8], eax
jmp 0x42ce18
mov eax, dword [0x476478]
test ecx, ecx
jne 0x42cea1
mov esi, eax
jmp 0x42ceda
lea eax, [ecx*2 + 0x22]
push eax
call fcn.004451f4
mov ecx, dword [ebp + 8]
add esp, 4
test eax, eax
je 0x42cee5
xor edx, edx
mov dword [eax], 1
mov word [eax + ecx*2 + 0x20], dx
lea esi, [eax + 0x20]
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0xc], edx
mov dword [eax + 8], edx
mov dword [eax + 4], edx
mov dword [eax + 0x10], edx
mov dword [ebp - 0x44], esi
mov eax, 1
mov dword [ebp - 0x30], esi
mov esi, dword [ebp - 0x30]
mov dword [esi - 0x14], 0
test eax, eax
je 0x42cf13
lea eax, [ecx + ecx]
push eax
push dword [ebp - 0x1c]
add eax, 2
push eax
push esi
call fcn.00445948
mov eax, dword [ebp + 8]
add esp, 0x10
xor ecx, ecx
mov dword [esi - 8], eax
mov word [esi + eax*2], cx
cmp dword [esi - 8], 0
je 0x42cf53
push str.Server
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x42cf36
call fcn.0041a5c0
test eax, eax
je 0x42cb9d
push str.Client
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x42cf53
call fcn.0041a5c0
test eax, eax
jne 0x42cb9d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], 0
test eax, eax
je 0x42cfa4
mov ecx, dword [eax + 0x10]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
mov dword [ebp + 8], eax
test ecx, ecx
jle 0x42cf9d
push 0x464528
push dword [eax]
call fcn.00446ab0
add esp, 8
test eax, eax
mov eax, dword [ebp + 8]
je 0x42d00d
mov ecx, dword [ebp - 0x1c]
add eax, 8
inc ecx
mov dword [ebp + 8], eax
mov dword [ebp - 0x1c], ecx
cmp ecx, dword [ebp - 0x14]
jl 0x42cf71
mov dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp + 8], ecx
lea edx, [esi - 0x20]
mov eax, 1
mov dword [ebp - 0x14], edx
cmp dword [edx], eax
jg 0x42cfc1
cmp ecx, dword [esi - 0xc]
jle 0x42d076
add esi, 0xffffffe0
cmp esi, dword [0x476474]
je 0x42d025
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x42cffb
mov eax, dword [edx + 0x10]
test eax, eax
je 0x42cff2
push eax
call fcn.00446dea
mov edx, dword [ebp - 0x14]
add esp, 4
mov dword [edx + 0x10], 0
push edx
call fcn.004471aa
add esp, 4
mov eax, dword [0x476478]
mov esi, eax
mov dword [ebp - 0x44], esi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x30], esi
jmp 0x42d02a
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x42cfa4
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
mov dword [ebp + 8], eax
jmp 0x42cfa9
mov eax, dword [0x476478]
test ecx, ecx
jne 0x42d032
mov esi, eax
jmp 0x42d06b
lea eax, [ecx*2 + 0x22]
push eax
call fcn.004451f4
mov ecx, dword [ebp + 8]
add esp, 4
test eax, eax
je 0x42d076
xor edx, edx
mov dword [eax], 1
mov word [eax + ecx*2 + 0x20], dx
lea esi, [eax + 0x20]
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0xc], edx
mov dword [eax + 8], edx
mov dword [eax + 4], edx
mov dword [eax + 0x10], edx
mov dword [ebp - 0x44], esi
mov eax, 1
mov dword [ebp - 0x30], esi
mov esi, dword [ebp - 0x30]
mov dword [esi - 0x14], 0
test eax, eax
je 0x42d0a4
lea eax, [ecx + ecx]
push eax
push dword [ebp - 0x1c]
add eax, 2
push eax
push esi
call fcn.00445948
mov eax, dword [ebp + 8]
add esp, 0x10
xor ecx, ecx
mov dword [esi - 8], eax
mov word [esi + eax*2], cx
cmp dword [esi - 8], 0
je 0x42d0be
push str.uninstall
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x42cb9d
push str.File
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x42da13
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42d0e6
mov esi, dword [0x476478]
mov dword [ebp - 0x6c], esi
jmp 0x42d146
mov ecx, dword [eax + 0x10]
xor edi, edi
mov esi, dword [eax + 0x28]
mov dword [ebp + 8], ecx
test ecx, ecx
jle 0x42d11c
jmp 0x42d100
push str.Source
push dword [esi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42d161
inc edi
add esi, 8
cmp edi, dword [ebp + 8]
jl 0x42d100
xor edi, edi
mov esi, dword [0x476478]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x6c], esi
test edi, edi
je 0x42d149
mov eax, edi
shr eax, 0x10
test eax, eax
jne 0x42d166
movzx eax, di
lea ecx, [ebp - 0x6c]
push eax
call fcn.0041c880
mov esi, dword [ebp - 0x6c]
mov dword [ebp - 0x34], esi
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42d199
mov eax, dword [0x476478]
mov dword [ebp - 0x40], eax
jmp 0x42d229
mov edi, dword [esi + 4]
jmp 0x42d11e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp + 8], eax
test eax, eax
je 0x42d149
push eax
lea ecx, [ebp - 0x6c]
call fcn.0040a900
test eax, eax
je 0x42d143
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 0x6c]
add eax, eax
push eax
push edi
push esi
mov dword [ebp - 0x34], esi
call fcn.004480a0
add esp, 0xc
jmp 0x42d149
mov ecx, dword [eax + 0x10]
mov edi, dword [eax + 0x28]
mov dword [ebp + 8], 0
mov dword [ebp - 0x14], ecx
test ecx, ecx
jle 0x42d1d2
lea ecx, [ecx]
push str.Destination
push dword [edi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42d1f7
mov eax, dword [ebp + 8]
add edi, 8
inc eax
mov dword [ebp + 8], eax
cmp eax, dword [ebp - 0x14]
jl 0x42d1b0
xor edi, edi
mov eax, dword [0x476478]
mov dword [ebp - 0x40], eax
test edi, edi
je 0x42d229
mov eax, edi
shr eax, 0x10
test eax, eax
jne 0x42d1fc
movzx eax, di
lea ecx, [ebp - 0x40]
push eax
call fcn.0041c880
jmp 0x42d229
mov edi, dword [edi + 4]
jmp 0x42d1d4
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp + 8], eax
test eax, eax
je 0x42d229
push eax
lea ecx, [ebp - 0x40]
call fcn.0040a900
test eax, eax
je 0x42d229
mov eax, dword [ebp + 8]
add eax, eax
push eax
push edi
push dword [ebp - 0x40]
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42d23f
mov edi, dword [0x476478]
mov dword [ebp - 0x7c], edi
jmp 0x42d2a7
mov ecx, dword [eax + 0x10]
mov edi, dword [eax + 0x28]
mov dword [ebp + 8], 0
mov dword [ebp - 0x14], ecx
test ecx, ecx
jle 0x42d279
push str.Type
push dword [edi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42d4cc
mov eax, dword [ebp + 8]
add edi, 8
inc eax
mov dword [ebp + 8], eax
cmp eax, dword [ebp - 0x14]
jl 0x42d253
xor ecx, ecx
mov edi, dword [0x476478]
mov dword [ebp + 8], ecx
mov dword [ebp - 0x7c], edi
test ecx, ecx
je 0x42d2a7
mov eax, ecx
shr eax, 0x10
test eax, eax
jne 0x42d4d4
movzx eax, cx
lea ecx, [ebp - 0x7c]
push eax
call fcn.0041c880
mov edi, dword [ebp - 0x7c]
mov byte [ebp - 4], 0x1a
push esi
call fcn.0043a8d0
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x40]
add esp, 4
push eax
call fcn.00411850
push 0
call fcn.00438c90
add esp, 4
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0xbc]
push eax
call fcn.00405440
mov byte [ebp - 4], 0x1f
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push eax
lea ecx, [ebp - 0xbc]
call fcn.00416980
mov byte [ebp - 4], 0x20
mov byte [ebp - 4], 0x1f
call fcn.00435680
add esp, 4
test eax, eax
je 0x42d30e
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x40]
push esi
mov eax, dword [esi - 8]
add eax, eax
mov dword [esi - 4], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42d94e
mov eax, dword [esi - 8]
add eax, eax
push esi
mov dword [esi - 4], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x42d519
push str.False
lea ecx, [ebp - 0x1d4]
call fcn.00405580
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x42d3a0
mov edx, dword [ecx + 0x10]
mov eax, dword [ecx + 0x28]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], edx
mov dword [ebp + 8], eax
test edx, edx
jle 0x42d3a0
push 0x4644c0
push dword [eax]
call fcn.00446ab0
add esp, 8
test eax, eax
mov eax, dword [ebp + 8]
je 0x42d511
mov ecx, dword [ebp - 0x1c]
add eax, 8
inc ecx
mov dword [ebp + 8], eax
mov dword [ebp - 0x1c], ecx
cmp ecx, dword [ebp - 0x14]
jl 0x42d374
xor ecx, ecx
mov eax, dword [ebp - 0x38]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
setne byte [ebp + 0xb]
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp - 0x1d4]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42d3ea
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42d3ea
mov eax, dword [ebp - 0x1d4]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
cmp byte [ebp + 0xb], 0
je 0x42d94e
push ecx
mov dword [ebp + 8], esp
lea eax, [ebp - 0x40]
mov dword [ebp - 0x2c], esp
push eax
push 0x464594
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Datei_wurde_erfolgreich_gel
call fcn.004054c0
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x160]
push eax
mov byte [ebp - 4], 0x1f
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x23
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x24
push eax
push dword [ebp + 8]
call fcn.004093a0
mov byte [ebp - 4], 0x25
mov byte [ebp - 4], 0x24
mov ecx, dword [ebp - 0x18]
call fcn.00437830
mov byte [ebp - 4], 0x23
mov eax, dword [ebp - 0x12c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42d491
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42d491
mov eax, dword [ebp - 0x12c]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp - 0x160]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42d94e
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42d94e
mov eax, dword [ebp - 0x160]
add eax, 0xffffffe0
push eax
jmp 0x42d946
mov ecx, dword [edi + 4]
jmp 0x42d27b
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x42d2a7
push eax
lea ecx, [ebp - 0x7c]
call fcn.0040a900
test eax, eax
je 0x42d2a4
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x7c]
add eax, eax
push eax
push dword [ebp + 8]
push edi
call fcn.004480a0
add esp, 0xc
jmp 0x42d2a7
mov ecx, dword [eax + 4]
jmp 0x42d3a2
mov eax, dword [esi - 8]
push 4
push 0
add eax, eax
push esi
mov dword [esi - 4], eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push str.False
lea ecx, [ebp - 0x168]
call fcn.00405580
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 0x26
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x42d58d
mov edx, dword [ecx + 0x10]
mov eax, dword [ecx + 0x28]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], edx
mov dword [ebp + 8], eax
test edx, edx
jle 0x42d58d
push 0x4644c0
push dword [eax]
call fcn.00446ab0
add esp, 8
test eax, eax
mov eax, dword [ebp + 8]
je 0x42d9b9
mov ecx, dword [ebp - 0x1c]
add eax, 8
inc ecx
mov dword [ebp + 8], eax
mov dword [ebp - 0x1c], ecx
cmp ecx, dword [ebp - 0x14]
jl 0x42d561
xor ecx, ecx
mov eax, dword [ebp - 0x38]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
setne byte [ebp + 0xb]
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp - 0x168]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42d5d7
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42d5d7
mov eax, dword [ebp - 0x168]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
cmp byte [ebp + 0xb], 0
je 0x42d831
push 0x4645e4
lea ecx, [ebp - 0x1bc]
call fcn.004054c0
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xdc]
push 0x4615e4
call fcn.004054c0
mov byte [ebp - 4], 0x28
lea eax, [ebp - 0x40]
push ecx
mov dword [ebp + 8], esp
mov dword [ebp - 0x2c], esp
push eax
lea eax, [ebp - 0x1bc]
push eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Die_wurde_zum_L
call fcn.004054c0
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x18c]
push eax
mov byte [ebp - 4], 0x28
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x2a
push eax
lea eax, [ebp - 0xdc]
push eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Die_Datei_konnte_nicht_gel
call fcn.004054c0
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x174]
push eax
mov byte [ebp - 4], 0x2a
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x2c
push eax
lea eax, [ebp - 0x1e8]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x2d
push eax
lea eax, [ebp - 0x1e0]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x2e
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x2f
push eax
push dword [ebp + 8]
call fcn.004093a0
mov byte [ebp - 4], 0x30
mov byte [ebp - 4], 0x2f
mov ecx, dword [ebp - 0x18]
call fcn.00437830
mov byte [ebp - 4], 0x2e
mov eax, dword [ebp - 0x1d0]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42d6ff
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42d6ff
mov eax, dword [ebp - 0x1d0]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x2d
mov eax, dword [ebp - 0x1e0]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42d735
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42d735
mov eax, dword [ebp - 0x1e0]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x1e8]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42d76b
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42d76b
mov eax, dword [ebp - 0x1e8]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x2a
mov eax, dword [ebp - 0x174]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42d7a1
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42d7a1
mov eax, dword [ebp - 0x174]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x28
mov eax, dword [ebp - 0x18c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42d7d7
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42d7d7
mov eax, dword [ebp - 0x18c]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0xdc]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42d804
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42d804
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp - 0x1bc]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42d831
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42d831
push ecx
call fcn.004471aa
add esp, 4
push 0x461560
lea ecx, [ebp - 0xec]
mov dword [ebp - 0x54], 1
call fcn.004054c0
mov byte [ebp - 4], 0x31
lea eax, [ebp - 0x40]
push ecx
mov dword [ebp + 8], esp
mov dword [ebp - 0x2c], esp
push eax
lea eax, [ebp - 0xec]
push eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Blockierte_Datei
call fcn.004054c0
mov byte [ebp - 4], 0x32
lea eax, [ebp - 0x194]
push eax
mov byte [ebp - 4], 0x31
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x33
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x34
push eax
push dword [ebp + 8]
call fcn.004093a0
mov byte [ebp - 4], 0x35
mov byte [ebp - 4], 0x34
mov ecx, dword [ebp - 0x18]
call fcn.00437830
mov byte [ebp - 4], 0x33
mov eax, dword [ebp - 0xe4]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42d8eb
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42d8eb
mov eax, dword [ebp - 0xe4]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x31
mov eax, dword [ebp - 0x194]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42d921
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42d921
mov eax, dword [ebp - 0x194]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp - 0xec]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42d94e
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42d94e
push ecx
call fcn.004471aa
add esp, 4
push 1
call fcn.00438c90
add esp, 4
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp - 0xbc]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42d98e
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42d98e
mov eax, dword [ebp - 0xbc]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x19
lea eax, [edi - 0x20]
cmp eax, dword [0x476474]
je 0x42d9c1
lea ecx, [edi - 0x20]
or edi, 0xffffffff
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42d9c4
push ecx
call fcn.004471aa
add esp, 4
jmp 0x42d9c4
mov ecx, dword [eax + 4]
jmp 0x42d58f
or edi, 0xffffffff
mov byte [ebp - 4], 0x18
lea eax, [esi - 0x20]
cmp eax, dword [0x476474]
je 0x42d9ea
add esi, 0xffffffe0
mov eax, edi
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x42d9ea
push esi
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0x34]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42da13
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42da13
push ecx
call fcn.004471aa
add esp, 4
push str.Registry
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x42e2d2
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42da41
mov esi, dword [0x476478]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x60], esi
jmp 0x42dad6
mov ecx, dword [eax + 0x10]
xor edi, edi
mov esi, dword [eax + 0x28]
mov dword [ebp + 8], ecx
test ecx, ecx
jle 0x42da6c
push str.Root
push dword [esi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42da9b
inc edi
add esi, 8
cmp edi, dword [ebp + 8]
jl 0x42da50
xor edi, edi
mov esi, dword [0x476478]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x60], esi
test edi, edi
je 0x42dad6
mov eax, edi
shr eax, 0x10
test eax, eax
jne 0x42daa0
movzx eax, di
lea ecx, [ebp - 0x60]
push eax
call fcn.0041c880
mov ecx, dword [ebp - 0x60]
mov dword [ebp - 0x34], ecx
jmp 0x42dad6
mov edi, dword [esi + 4]
jmp 0x42da6e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x42dad6
push esi
lea ecx, [ebp - 0x60]
call fcn.0040a900
test eax, eax
je 0x42dad0
lea eax, [esi + esi]
mov esi, dword [ebp - 0x60]
push eax
push edi
push esi
mov dword [ebp - 0x34], esi
call fcn.004480a0
add esp, 0xc
jmp 0x42dad6
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 0x37
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42daf2
mov esi, dword [0x476478]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x58], esi
jmp 0x42db87
mov ecx, dword [eax + 0x10]
xor edi, edi
mov esi, dword [eax + 0x28]
mov dword [ebp + 8], ecx
test ecx, ecx
jle 0x42db1d
push str.Type
push dword [esi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42db4c
inc edi
add esi, 8
cmp edi, dword [ebp + 8]
jl 0x42db01
xor edi, edi
mov esi, dword [0x476478]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x58], esi
test edi, edi
je 0x42db87
mov eax, edi
shr eax, 0x10
test eax, eax
jne 0x42db51
movzx eax, di
lea ecx, [ebp - 0x58]
push eax
call fcn.0041c880
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x1c], ecx
jmp 0x42db87
mov edi, dword [esi + 4]
jmp 0x42db1f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x42db87
push esi
lea ecx, [ebp - 0x58]
call fcn.0040a900
test eax, eax
je 0x42db81
lea eax, [esi + esi]
mov esi, dword [ebp - 0x58]
push eax
push edi
push esi
mov dword [ebp - 0x1c], esi
call fcn.004480a0
add esp, 0xc
jmp 0x42db87
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0x38
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42dba3
mov esi, dword [0x476478]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x48], esi
jmp 0x42dc38
mov ecx, dword [eax + 0x10]
xor edi, edi
mov esi, dword [eax + 0x28]
mov dword [ebp + 8], ecx
test ecx, ecx
jle 0x42dbce
push 0x463c00
push dword [esi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42dbfd
inc edi
add esi, 8
cmp edi, dword [ebp + 8]
jl 0x42dbb2
xor edi, edi
mov esi, dword [0x476478]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x48], esi
test edi, edi
je 0x42dc38
mov eax, edi
shr eax, 0x10
test eax, eax
jne 0x42dc02
movzx eax, di
lea ecx, [ebp - 0x48]
push eax
call fcn.0041c880
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x38], ecx
jmp 0x42dc38
mov edi, dword [esi + 4]
jmp 0x42dbd0
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x42dc38
push esi
lea ecx, [ebp - 0x48]
call fcn.0040a900
test eax, eax
je 0x42dc32
lea eax, [esi + esi]
mov esi, dword [ebp - 0x48]
push eax
push edi
push esi
mov dword [ebp - 0x38], esi
call fcn.004480a0
add esp, 0xc
jmp 0x42dc38
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 0x39
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42dc54
mov esi, dword [0x476478]
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x64], esi
jmp 0x42dce9
mov ecx, dword [eax + 0x10]
xor edi, edi
mov esi, dword [eax + 0x28]
mov dword [ebp + 8], ecx
test ecx, ecx
jle 0x42dc7f
push str.Name
push dword [esi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42dcae
inc edi
add esi, 8
cmp edi, dword [ebp + 8]
jl 0x42dc63
xor edi, edi
mov esi, dword [0x476478]
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x64], esi
test edi, edi
je 0x42dce9
mov eax, edi
shr eax, 0x10
test eax, eax
jne 0x42dcb3
movzx eax, di
lea ecx, [ebp - 0x64]
push eax
call fcn.0041c880
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x80], ecx
jmp 0x42dce9
mov edi, dword [esi + 4]
jmp 0x42dc81
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x42dce9
push esi
lea ecx, [ebp - 0x64]
call fcn.0040a900
test eax, eax
je 0x42dce3
lea eax, [esi + esi]
mov esi, dword [ebp - 0x64]
push eax
push edi
push esi
mov dword [ebp - 0x80], esi
call fcn.004480a0
add esp, 0xc
jmp 0x42dce9
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x80], eax
mov byte [ebp - 4], 0x3a
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42dd08
mov esi, dword [0x476478]
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x70], esi
jmp 0x42ddb2
mov ecx, dword [eax + 0x10]
xor edi, edi
mov esi, dword [eax + 0x28]
mov dword [ebp + 8], ecx
test ecx, ecx
jle 0x42dd3c
jmp 0x42dd20
push str.DeleteEntry
push dword [esi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42dd71
inc edi
add esi, 8
cmp edi, dword [ebp + 8]
jl 0x42dd20
xor edi, edi
mov esi, dword [0x476478]
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x70], esi
test edi, edi
je 0x42ddb2
mov eax, edi
shr eax, 0x10
test eax, eax
jne 0x42dd76
movzx eax, di
lea ecx, [ebp - 0x70]
push eax
call fcn.0041c880
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x94], ecx
jmp 0x42ddb2
mov edi, dword [esi + 4]
jmp 0x42dd3e
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x42ddb2
push esi
lea ecx, [ebp - 0x70]
call fcn.0040a900
test eax, eax
je 0x42dda9
lea eax, [esi + esi]
mov esi, dword [ebp - 0x70]
push eax
push edi
push esi
mov dword [ebp - 0x94], esi
call fcn.004480a0
add esp, 0xc
jmp 0x42ddb2
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 0x3b
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42ddc8
mov edi, dword [0x476478]
mov dword [ebp - 0x68], edi
jmp 0x42de23
mov ecx, dword [eax + 0x10]
xor edi, edi
mov esi, dword [eax + 0x28]
mov dword [ebp + 8], ecx
test ecx, ecx
jle 0x42ddfc
jmp 0x42dde0
push str.DeleteKey
push dword [esi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42de3b
inc edi
add esi, 8
cmp edi, dword [ebp + 8]
jl 0x42dde0
xor esi, esi
mov edi, dword [0x476478]
mov dword [ebp - 0x68], edi
test esi, esi
je 0x42de23
mov eax, esi
shr eax, 0x10
test eax, eax
jne 0x42de40
movzx eax, si
lea ecx, [ebp - 0x68]
push eax
call fcn.0041c880
mov edi, dword [ebp - 0x68]
mov byte [ebp - 4], 0x3c
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x42de70
mov eax, dword [0x476478]
mov dword [ebp - 0x5c], eax
jmp 0x42defd
mov esi, dword [esi + 4]
jmp 0x42ddfe
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp + 8], eax
test eax, eax
je 0x42de23
push eax
lea ecx, [ebp - 0x68]
call fcn.0040a900
test eax, eax
je 0x42de20
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x68]
add eax, eax
push eax
push esi
push edi
call fcn.004480a0
add esp, 0xc
jmp 0x42de23
mov ecx, dword [eax + 0x10]
mov esi, dword [eax + 0x28]
mov dword [ebp + 8], 0
mov dword [ebp - 0x14], ecx
test ecx, ecx
jle 0x42dea6
push str.Value
push dword [esi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42decb
mov eax, dword [ebp + 8]
add esi, 8
inc eax
mov dword [ebp + 8], eax
cmp eax, dword [ebp - 0x14]
jl 0x42de84
xor esi, esi
mov eax, dword [0x476478]
mov dword [ebp - 0x5c], eax
test esi, esi
je 0x42defd
mov eax, esi
shr eax, 0x10
test eax, eax
jne 0x42ded0
movzx eax, si
lea ecx, [ebp - 0x5c]
push eax
call fcn.0041c880
jmp 0x42defd
mov esi, dword [esi + 4]
jmp 0x42dea8
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp + 8], eax
test eax, eax
je 0x42defd
push eax
lea ecx, [ebp - 0x5c]
call fcn.0040a900
test eax, eax
je 0x42defd
mov eax, dword [ebp + 8]
add eax, eax
push eax
push esi
push dword [ebp - 0x5c]
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 0x3d
lea eax, [ebp - 0x5c]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.00411850
mov esi, dword [ebp - 0x34]
push str.HKLM
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ecx, dword [ebp - 0xc4]
test eax, eax
mov eax, reloc.OLEAUT32.dll_SysReAllocString
push str.HKCU
cmove ecx, eax
push esi
mov dword [ebp - 0xc4], ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ecx, dword [ebp - 0xc4]
test eax, eax
mov eax, SysReAllocString
cmove ecx, eax
mov eax, dword [0x476478]
mov dword [ebp - 0xc4], ecx
mov dword [ebp - 0x250], eax
mov byte [ebp - 4], 0x3e
mov dword [ebp - 0x258], SysReAllocString
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x24c], 0x100
mov dword [ebp - 0x244], 0
mov byte [ebp - 4], 0x3f
cmp ecx, 0x80000000
je 0x42dfb9
cmp ecx, 0x80000001
je 0x42dfb9
cmp ecx, reloc.OLEAUT32.dll_SysReAllocString
je 0x42dfb9
cmp ecx, 0x80000003
jne 0x42e00f
push 0xf003f
push 1
push ecx
mov dword [ebp - 0x258], ecx
lea eax, [ebp - 0x48]
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.00405440
mov byte [ebp - 4], 0x40
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x25c]
call fcn.0042b170
test eax, eax
je 0x42e00f
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push str.csName
call fcn.00405580
mov byte [ebp - 4], 0x41
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x25c]
call fcn.0040f860
mov esi, dword [0x476478]
mov ecx, str.False
mov eax, ecx
mov dword [ebp - 0x88], esi
shr eax, 0x10
test eax, eax
jne 0x42e8e0
movzx eax, cx
lea ecx, [ebp - 0x88]
push eax
call fcn.0041c880
mov esi, dword [ebp - 0x88]
mov byte [ebp - 4], 0x42
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x42e090
mov ecx, dword [eax + 0x10]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x2c], ecx
mov dword [ebp + 8], eax
test ecx, ecx
jle 0x42e090
push 0x4644c0
push dword [eax]
call fcn.00446ab0
add esp, 8
test eax, eax
mov eax, dword [ebp + 8]
je 0x42e929
mov ecx, dword [ebp - 0x14]
add eax, 8
inc ecx
mov dword [ebp + 8], eax
mov dword [ebp - 0x14], ecx
cmp ecx, dword [ebp - 0x2c]
jl 0x42e064
xor eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
setne byte [ebp + 0xb]
mov byte [ebp - 4], 0x3f
lea eax, [esi - 0x20]
cmp eax, dword [0x476474]
je 0x42e0c7
add esi, 0xffffffe0
or eax, 0xffffffff
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x42e0c7
push esi
call fcn.004471aa
add esp, 4
cmp byte [ebp + 0xb], 0
je 0x42e1a1
push ecx
mov esi, esp
mov dword [ebp + 8], esp
lea eax, [ebp - 0x48]
push eax
push 0x4615dc
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.Eintrag_aus_der_Registry_erfolgreich_gel
call fcn.004054c0
mov byte [ebp - 4], 0x43
lea eax, [ebp - 0x19c]
push eax
mov byte [ebp - 4], 0x3f
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x44
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x45
push eax
push esi
call fcn.004093a0
mov byte [ebp - 4], 0x46
mov byte [ebp - 4], 0x45
mov ecx, dword [ebp - 0x18]
call fcn.00437830
mov byte [ebp - 4], 0x44
mov eax, dword [ebp - 0xf4]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42e16b
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42e16b
mov eax, dword [ebp - 0xf4]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x3f
mov eax, dword [ebp - 0x19c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42e1a1
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42e1a1
mov eax, dword [ebp - 0x19c]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x25c]
call fcn.00408bd0
mov byte [ebp - 4], 0x3c
or esi, 0xffffffff
mov eax, dword [ebp - 0x5c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42e1dc
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42e1dc
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x3b
lea eax, [edi - 0x20]
cmp eax, dword [0x476474]
je 0x42e202
add edi, 0xffffffe0
mov eax, esi
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x42e202
push edi
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x3a
mov eax, dword [ebp - 0x94]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42e22e
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42e22e
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x39
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42e257
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42e257
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x38
mov eax, dword [ebp - 0x38]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42e280
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42e280
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x37
mov eax, dword [ebp - 0x1c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42e2a9
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42e2a9
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0x34]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42e2d2
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42e2d2
push ecx
call fcn.004471aa
add esp, 4
push str.Service
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x42e7d4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x42e320
mov ecx, dword [eax + 0x10]
xor edi, edi
mov esi, dword [eax + 0x28]
mov dword [ebp + 8], ecx
test ecx, ecx
jle 0x42e320
mov edi, edi
push str.InstallService
push dword [esi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42e931
inc edi
add esi, 8
cmp edi, dword [ebp + 8]
jl 0x42e300
xor eax, eax
push eax
lea ecx, [ebp - 0x200]
call fcn.00405580
mov byte [ebp - 4], 0x47
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x42e370
mov ecx, dword [eax + 0x10]
xor edi, edi
mov esi, dword [eax + 0x28]
mov dword [ebp + 8], ecx
test ecx, ecx
jle 0x42e370
jmp 0x42e350
push str.DisplayName
push dword [esi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42e939
inc edi
add esi, 8
cmp edi, dword [ebp + 8]
jl 0x42e350
xor eax, eax
push eax
lea ecx, [ebp - 0x1fc]
call fcn.00405580
mov byte [ebp - 4], 0x48
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x42e3c0
mov ecx, dword [eax + 0x10]
xor edi, edi
mov esi, dword [eax + 0x28]
mov dword [ebp + 8], ecx
test ecx, ecx
jle 0x42e3c0
jmp 0x42e3a0
push str.Description
push dword [esi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42e941
inc edi
add esi, 8
cmp edi, dword [ebp + 8]
jl 0x42e3a0
xor eax, eax
push eax
lea ecx, [ebp - 0x20c]
call fcn.00405580
mov byte [ebp - 4], 0x49
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x42e410
mov ecx, dword [eax + 0x10]
xor edi, edi
mov esi, dword [eax + 0x28]
mov dword [ebp + 8], ecx
test ecx, ecx
jle 0x42e410
jmp 0x42e3f0
push str.StartType
push dword [esi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42e949
inc edi
add esi, 8
cmp edi, dword [ebp + 8]
jl 0x42e3f0
xor eax, eax
push eax
lea ecx, [ebp - 0x1f4]
call fcn.00405580
mov byte [ebp - 4], 0x4a
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x42e460
mov ecx, dword [eax + 0x10]
xor edi, edi
mov esi, dword [eax + 0x28]
mov dword [ebp + 8], ecx
test ecx, ecx
jle 0x42e460
jmp 0x42e440
push str.ProcessType
push dword [esi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42e951
inc edi
add esi, 8
cmp edi, dword [ebp + 8]
jl 0x42e440
xor eax, eax
push eax
lea ecx, [ebp - 0x1f8]
call fcn.00405580
mov byte [ebp - 4], 0x4b
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x42e4b0
mov ecx, dword [eax + 0x10]
xor edi, edi
mov esi, dword [eax + 0x28]
mov dword [ebp + 8], ecx
test ecx, ecx
jle 0x42e4b0
jmp 0x42e490
push str.StartService
push dword [esi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42e959
inc edi
add esi, 8
cmp edi, dword [ebp + 8]
jl 0x42e490
xor eax, eax
push eax
lea ecx, [ebp - 0x1f0]
call fcn.00405580
mov byte [ebp - 4], 0x4c
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x42e500
mov ecx, dword [eax + 0x10]
xor edi, edi
mov esi, dword [eax + 0x28]
mov dword [ebp + 8], ecx
test ecx, ecx
jle 0x42e500
jmp 0x42e4e0
push str.StopService
push dword [esi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42e961
inc edi
add esi, 8
cmp edi, dword [ebp + 8]
jl 0x42e4e0
xor eax, eax
push eax
lea ecx, [ebp - 0x204]
call fcn.00405580
mov byte [ebp - 4], 0x4d
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x42e550
mov ecx, dword [eax + 0x10]
xor edi, edi
mov esi, dword [eax + 0x28]
mov dword [ebp + 8], ecx
test ecx, ecx
jle 0x42e550
jmp 0x42e530
push str.BinaryFile
push dword [esi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42e969
inc edi
add esi, 8
cmp edi, dword [ebp + 8]
jl 0x42e530
xor eax, eax
push eax
lea ecx, [ebp - 0x1c4]
call fcn.00405580
mov byte [ebp - 4], 0x4e
lea eax, [ebp - 0x1c4]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.00411850
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, dword [ebp - 0x200]
push 0xf01ff
push esi
push eax
mov ecx, dword [esi - 8]
add ecx, ecx
mov dword [ebp - 0x2c], eax
mov dword [esi - 4], ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
je 0x42e669
lea eax, [ebp - 0x278]
mov dword [ebp - 0x260], 0
xorps xmm0, xmm0
push eax
push edi
movdqu xmmword [ebp - 0x278], xmm0
movq qword [ebp - 0x268], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x274], 1
je 0x42e5ef
lea eax, [ebp - 0x278]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push str.False
lea ecx, [ebp - 0xfc]
call fcn.00405580
mov edi, eax
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x10]
push 0
push 0x4644c0
call fcn.0043edc0
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
setne byte [ebp + 0xb]
mov byte [ebp - 4], 0x4e
mov eax, dword [ebp - 0xfc]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42e659
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42e659
mov eax, dword [ebp - 0xfc]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
cmp byte [ebp + 0xb], 0
mov edi, dword [ebp - 0x14]
je 0x42e669
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push dword [ebp - 0x2c]
call edi
mov byte [ebp - 4], 0x4d
or edi, 0xffffffff
mov eax, dword [ebp - 0x1c4]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42e6a6
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42e6a6
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x4c
mov eax, dword [ebp - 0x204]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42e6d2
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42e6d2
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x4b
mov eax, dword [ebp - 0x1f0]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42e6fe
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42e6fe
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x4a
mov eax, dword [ebp - 0x1f8]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42e72a
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42e72a
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x49
mov eax, dword [ebp - 0x1f4]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42e756
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42e756
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x48
mov eax, dword [ebp - 0x20c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42e782
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42e782
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x47
mov eax, dword [ebp - 0x1fc]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42e7ae
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42e7ae
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x17
lea eax, [esi - 0x20]
cmp eax, dword [0x476474]
je 0x42e7d4
add esi, 0xffffffe0
mov eax, edi
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x42e7d4
push esi
call fcn.004471aa
add esp, 4
push str.RegSvr32
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x42ed91
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x42e820
mov ecx, dword [eax + 0x10]
xor edi, edi
mov esi, dword [eax + 0x28]
mov dword [ebp + 8], ecx
test ecx, ecx
jle 0x42e820
push str.File
push dword [esi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42e971
inc edi
add esi, 8
cmp edi, dword [ebp + 8]
jl 0x42e800
xor eax, eax
push eax
lea ecx, [ebp - 0x9c]
call fcn.00405580
mov byte [ebp - 4], 0x50
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x42e870
mov ecx, dword [eax + 0x10]
xor edi, edi
mov esi, dword [eax + 0x28]
mov dword [ebp + 8], ecx
test ecx, ecx
jle 0x42e870
jmp 0x42e850
push str.Parameter
push dword [esi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x42e979
inc edi
add esi, 8
cmp edi, dword [ebp + 8]
jl 0x42e850
xor eax, eax
push eax
lea ecx, [ebp - 0x124]
call fcn.00405580
mov byte [ebp - 4], 0x51
lea eax, [ebp - 0x9c]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.00411850
mov eax, dword [0x476478]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 4], 0x52
mov eax, dword [0x476478]
mov dword [ebp - 0xb8], eax
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0xcc]
push 0x104
push 0x104
call fcn.00414150
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, dword [ebp - 0xcc]
test esi, esi
jne 0x42e981
xor eax, eax
jmp 0x42e988
push str.False
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp + 8], eax
test eax, eax
je 0x42e042
push eax
lea ecx, [ebp - 0x88]
call fcn.0040a900
test eax, eax
je 0x42e03c
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 0x88]
add eax, eax
push eax
push str.False
push esi
call fcn.004480a0
add esp, 0xc
jmp 0x42e042
mov eax, dword [eax + 4]
jmp 0x42e092
mov eax, dword [esi + 4]
jmp 0x42e322
mov eax, dword [esi + 4]
jmp 0x42e372
mov eax, dword [esi + 4]
jmp 0x42e3c2
mov eax, dword [esi + 4]
jmp 0x42e412
mov eax, dword [esi + 4]
jmp 0x42e462
mov eax, dword [esi + 4]
jmp 0x42e4b2
mov eax, dword [esi + 4]
jmp 0x42e502
mov eax, dword [esi + 4]
jmp 0x42e552
mov eax, dword [esi + 4]
jmp 0x42e822
mov eax, dword [esi + 4]
jmp 0x42e872
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [esi - 8], eax
lea eax, [ebp - 0xcc]
push str._system32
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0xb8]
push eax
call fcn.00408f00
mov byte [ebp - 4], 0x53
or edi, 0xffffffff
mov eax, dword [ebp - 0x104]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42e9eb
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42e9eb
mov eax, dword [ebp - 0x104]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
push 0x44
lea eax, [ebp - 0x34c]
mov dword [ebp - 0x2f8], 0
push 0
push eax
call fcn.004486f0
add esp, 8
mov dword [ebp - 0x34c], 0x44
xorps xmm0, xmm0
mov dword [ebp + 8], esp
mov ecx, esp
movdqu xmmword [ebp - 0x308], xmm0
push 0x46155c
call fcn.00405580
mov byte [ebp - 4], 0x55
lea eax, [ebp - 0x124]
push eax
push str.__u__s
lea eax, [ebp - 0x1e4]
push eax
call fcn.00409520
mov byte [ebp - 4], 0x56
push 0x464480
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0x9c]
push ecx
push eax
lea eax, [ebp - 0x1a4]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x58
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push 0x4627a0
push eax
push ecx
call fcn.00409410
mov byte [ebp - 4], 0x59
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push str._regsvr32.exe
lea ecx, [ebp - 0xb8]
push ecx
push eax
call fcn.00409410
mov byte [ebp - 4], 0x5a
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x34c]
call fcn.0040d280
mov byte [ebp - 4], 0x5c
mov eax, dword [ebp - 0x1a4]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42eaf0
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42eaf0
mov eax, dword [ebp - 0x1a4]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x5b
mov eax, dword [ebp - 0x10c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42eb25
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42eb25
mov eax, dword [ebp - 0x10c]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x53
mov eax, dword [ebp - 0x1e4]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42eb5a
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42eb5a
mov eax, dword [ebp - 0x1e4]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
push str.False
lea ecx, [ebp - 0x114]
call fcn.00405580
mov edi, eax
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x10]
push 0
push 0x4644c0
call fcn.0043edc0
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
setne byte [ebp + 0xb]
mov byte [ebp - 4], 0x53
mov eax, dword [ebp - 0x114]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42ebc4
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42ebc4
mov eax, dword [ebp - 0x114]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
cmp byte [ebp + 0xb], 0
je 0x42ece4
push str.:__r_n
lea ecx, [ebp - 0x170]
call fcn.004054c0
mov byte [ebp - 4], 0x5f
lea eax, [ebp - 0x9c]
push ecx
mov edi, esp
mov dword [ebp + 8], esp
push eax
lea eax, [ebp - 0x170]
push eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.Registrierung_interaktiver_Komponenten_entfernt
call fcn.004054c0
mov byte [ebp - 4], 0x60
lea eax, [ebp - 0x11c]
push eax
mov byte [ebp - 4], 0x5f
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x61
push eax
lea eax, [ebp - 0x1ac]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x62
push eax
push edi
call fcn.004093a0
mov byte [ebp - 4], 0x63
mov byte [ebp - 4], 0x62
mov ecx, dword [ebp - 0x18]
call fcn.00437830
mov byte [ebp - 4], 0x61
or edi, 0xffffffff
mov eax, dword [ebp - 0x1ac]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42ec83
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42ec83
mov eax, dword [ebp - 0x1ac]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x5f
mov eax, dword [ebp - 0x11c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42ecb8
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42ecb8
mov eax, dword [ebp - 0x11c]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x53
mov eax, dword [ebp - 0x170]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42ece4
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42ece4
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x52
or edi, 0xffffffff
mov eax, dword [ebp - 0xb8]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42ed13
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42ed13
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x51
lea eax, [esi - 0x20]
cmp eax, dword [0x476474]
je 0x42ed39
add esi, 0xffffffe0
mov eax, edi
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x42ed39
push esi
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x50
mov eax, dword [ebp - 0x124]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42ed65
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42ed65
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0x9c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42ed91
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42ed91
push ecx
call fcn.004471aa
add esp, 4
push str.DriverInf
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x42f106
cmp dword [ebp + 0xc], eax
jne 0x42f106
push eax
push 0x4614f4
lea ecx, [ebp - 0x10]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x214]
call fcn.00405580
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0x10]
push 0
push str.File
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x180]
call fcn.00405580
mov byte [ebp - 4], 0x65
lea ecx, [ebp - 0x10]
push 0
push str.Binary
call fcn.0043edc0
push eax
lea ecx, [ebp - 0xa4]
call fcn.00405580
mov byte [ebp - 4], 0x66
lea eax, [ebp - 0x180]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.00411850
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0xa4]
push eax
call fcn.00411850
lea ecx, [ebp - 0x29c]
call fcn.004053c0
mov byte [ebp - 4], 0x67
lea ecx, [ebp - 0x29c]
push 0
push 0
push 0xf003f
call fcn.00424060
mov edi, dword [ebp - 0x214]
test eax, eax
je 0x42ef7c
mov eax, dword [edi - 8]
lea ecx, [ebp - 0x29c]
add eax, eax
push edi
mov dword [edi - 4], eax
call fcn.00435020
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call esi
mov eax, dword [edi - 8]
lea ecx, [ebp - 0x29c]
add eax, eax
push edi
mov dword [edi - 4], eax
call fcn.004280c0
push 0x7d0
call esi
mov eax, dword [edi - 8]
lea ecx, [ebp - 0x29c]
add eax, eax
mov dword [ebp + 8], 0
mov dword [edi - 4], eax
lea eax, [ebp + 8]
push eax
push edi
call fcn.0041a0c0
cmp dword [ebp + 8], 0
je 0x42ef71
push 0x461560
lea ecx, [ebp - 0x178]
call fcn.004054c0
mov byte [ebp - 4], 0x68
lea eax, [ebp - 0xa4]
push ecx
mov esi, esp
mov dword [ebp + 8], esp
push eax
lea eax, [ebp - 0x178]
push eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x2c], esp
push str.Blockierter_Dienst
call fcn.004054c0
mov byte [ebp - 4], 0x69
lea eax, [ebp - 0x208]
push eax
mov byte [ebp - 4], 0x68
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x6a
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x6b
push eax
push esi
call fcn.004093a0
mov byte [ebp - 4], 0x6c
mov byte [ebp - 4], 0x6b
mov ecx, dword [ebp - 0x18]
call fcn.00437830
mov byte [ebp - 4], 0x6a
lea ecx, [ebp - 0x21c]
call fcn.004087b0
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0x208]
call fcn.004087b0
mov byte [ebp - 4], 0x67
lea ecx, [ebp - 0x178]
call fcn.004087b0
mov dword [ebp - 0x54], 1
lea ecx, [ebp - 0x29c]
call fcn.0040cc20
mov esi, dword [ebp - 0xa4]
push esi
mov eax, dword [esi - 8]
add eax, eax
mov dword [esi - 4], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42f077
mov eax, dword [esi - 8]
add eax, eax
push esi
mov dword [esi - 4], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x42f077
mov eax, dword [esi - 8]
push 4
push 0
add eax, eax
push esi
mov dword [esi - 4], eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x461560
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0x54], 1
call fcn.004054c0
mov byte [ebp - 4], 0x6d
lea eax, [ebp - 0xa4]
push ecx
mov dword [ebp + 8], esp
mov dword [ebp - 0x2c], esp
push eax
lea eax, [ebp - 0xd0]
push eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Blockierte_Datei
call fcn.004054c0
mov byte [ebp - 4], 0x6e
lea eax, [ebp - 0x210]
push eax
mov byte [ebp - 4], 0x6d
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x6f
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x70
push eax
push dword [ebp + 8]
call fcn.004093a0
mov byte [ebp - 4], 0x71
mov byte [ebp - 4], 0x70
mov ecx, dword [ebp - 0x18]
call fcn.00437830
mov byte [ebp - 4], 0x6f
lea ecx, [ebp - 0x218]
call fcn.004087b0
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x210]
call fcn.004087b0
mov byte [ebp - 4], 0x67
lea ecx, [ebp - 0xd0]
call fcn.004087b0
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x29c]
call fcn.004086e0
mov byte [ebp - 4], 0x65
lea eax, [esi - 0x20]
cmp eax, dword [0x476474]
je 0x42f0b1
lea ecx, [esi - 0x20]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42f0b4
push ecx
call fcn.004471aa
add esp, 4
jmp 0x42f0b4
or esi, 0xffffffff
mov byte [ebp - 4], 0x64
mov eax, dword [ebp - 0x180]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42f0e0
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42f0e0
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x17
lea eax, [edi - 0x20]
cmp eax, dword [0x476474]
je 0x42f106
add edi, 0xffffffe0
mov eax, esi
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x42f106
push edi
call fcn.004471aa
add esp, 4
push str.CopyFile
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x42f307
push eax
push str.From
lea ecx, [ebp - 0x10]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x134]
call fcn.00405580
mov byte [ebp - 4], 0x72
lea ecx, [ebp - 0x10]
push 0
push 0x46486c
call fcn.0043edc0
push eax
lea ecx, [ebp - 0xb4]
call fcn.00405580
mov byte [ebp - 4], 0x73
lea ecx, [ebp - 0x10]
push 0
push str.Overwrite
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x3c]
call fcn.00405580
mov byte [ebp - 4], 0x74
lea eax, [ebp - 0x134]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.00411850
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0xb4]
push eax
call fcn.00411850
mov edi, dword [ebp - 0x134]
mov esi, dword [ebp - 0xb4]
cmp dword [edi - 8], 0
jle 0x42f28f
mov eax, dword [esi - 8]
test eax, eax
jle 0x42f28f
add eax, eax
push esi
mov dword [esi - 4], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x42f28f
mov eax, dword [esi - 8]
push 4
push 0
add eax, eax
push esi
mov dword [esi - 4], eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x461560
lea ecx, [ebp - 0x188]
mov dword [ebp - 0x54], 1
call fcn.004054c0
mov byte [ebp - 4], 0x75
lea eax, [ebp - 0xb4]
push ecx
mov dword [ebp + 8], esp
mov dword [ebp - 0x2c], esp
push eax
lea eax, [ebp - 0x188]
push eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Blockierte_Datei
call fcn.004054c0
mov byte [ebp - 4], 0x76
lea eax, [ebp - 0x98]
push eax
mov byte [ebp - 4], 0x75
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x77
push eax
lea eax, [ebp - 0x1d8]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x78
push eax
push dword [ebp + 8]
call fcn.004093a0
mov byte [ebp - 4], 0x79
mov byte [ebp - 4], 0x78
mov ecx, dword [ebp - 0x18]
call fcn.00437830
mov byte [ebp - 4], 0x77
lea ecx, [ebp - 0x1d8]
call fcn.004087b0
mov byte [ebp - 4], 0x75
lea ecx, [ebp - 0x98]
call fcn.004087b0
mov byte [ebp - 4], 0x74
lea ecx, [ebp - 0x188]
call fcn.004087b0
mov byte [ebp - 4], 0x73
mov eax, dword [ebp - 0x3c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42f2b9
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42f2b9
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x72
lea eax, [esi - 0x20]
cmp eax, dword [0x476474]
je 0x42f2e0
add esi, 0xffffffe0
or eax, 0xffffffff
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x42f2e0
push esi
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x17
lea eax, [edi - 0x20]
cmp eax, dword [0x476474]
je 0x42f307
add edi, 0xffffffe0
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x42f307
push edi
call fcn.004471aa
add esp, 4
push str.Shortcut
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x43027a
push 0x206
push eax
mov word [ebp - 0x670], ax
lea eax, [ebp - 0x66e]
push eax
call fcn.004486f0
add esp, 0xc
mov dword [ebp - 0x2c], 0x104
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
lea eax, [ebp - 0x670]
push eax
lea ecx, [ebp - 0x20]
call fcn.00405580
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0xc0]
push str.AppDataRoamingMicrosoftWindowsStart_MenuPrograms
call fcn.00405580
mov byte [ebp - 4], 0x7b
lea ecx, [ebp - 0x4c]
push str.Desktop
call fcn.00405580
mov byte [ebp - 4], 0x7c
lea ecx, [ebp - 0x10]
push 0
push str.File
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x158]
call fcn.00405580
mov byte [ebp - 4], 0x7d
lea ecx, [ebp - 0x10]
push 0
push str.Name
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x78]
call fcn.00405580
mov byte [ebp - 4], 0x7e
lea ecx, [ebp - 0x10]
push 0
push str.Location
call fcn.0043edc0
push eax
lea ecx, [ebp - 0xb0]
call fcn.00405580
mov byte [ebp - 4], 0x7f
lea eax, [ebp - 0x158]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.00411850
mov esi, dword [ebp - 0xb0]
push str.programs
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x42f8ff
mov eax, dword [0x476478]
mov dword [ebp - 0x8c], eax
mov byte [ebp - 4], 0x80
mov eax, dword [0x476478]
mov dword [ebp - 0x74], eax
mov byte [ebp - 4], 0x81
lea ecx, [ebp - 0x8c]
push 1
push 2
push 0x104
call fcn.00414150
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, dword [ebp - 0x8c]
test edi, edi
jne 0x42f452
xor eax, eax
jmp 0x42f459
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [edi - 8], eax
lea eax, [ebp - 0x8c]
push 0x461514
push eax
lea eax, [ebp - 0x154]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x82
mov ecx, dword [ebp - 0x18]
add ecx, 0x318
push ecx
push eax
lea eax, [ebp - 0x1a0]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x83
push 0x461514
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x84
push dword [ebp - 0xc8]
push eax
lea eax, [ebp - 0x198]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x85
push 0x461514
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x86
lea ecx, [ebp - 0x78]
push ecx
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x87
push str..lnk
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x88
lea ecx, [ebp - 0x74]
push eax
call fcn.00408f00
mov byte [ebp - 4], 0x87
or esi, 0xffffffff
mov eax, dword [ebp - 0x13c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42f542
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42f542
mov eax, dword [ebp - 0x13c]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x86
mov eax, dword [ebp - 0x190]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42f577
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42f577
mov eax, dword [ebp - 0x190]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x85
mov eax, dword [ebp - 0x144]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42f5ac
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42f5ac
mov eax, dword [ebp - 0x144]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x84
mov eax, dword [ebp - 0x198]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42f5e1
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42f5e1
mov eax, dword [ebp - 0x198]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x83
mov eax, dword [ebp - 0x14c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42f616
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42f616
mov eax, dword [ebp - 0x14c]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x82
mov eax, dword [ebp - 0x1a0]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42f64b
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42f64b
mov eax, dword [ebp - 0x1a0]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x81
mov eax, dword [ebp - 0x154]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42f680
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42f680
mov eax, dword [ebp - 0x154]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov eax, dword [ebp - 0x74]
push eax
mov ecx, dword [eax - 8]
add ecx, ecx
mov dword [eax - 4], ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x461514
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x164]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x89
mov ecx, dword [ebp - 0x18]
add ecx, 0x318
push ecx
push eax
lea eax, [ebp - 0x1b0]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x8a
push 0x461514
push eax
lea eax, [ebp - 0x15c]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x8b
push dword [ebp - 0xc8]
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x8c
lea ecx, [ebp - 0x74]
push eax
call fcn.00408f00
mov byte [ebp - 4], 0x8b
mov eax, dword [ebp - 0x1a8]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42f734
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42f734
mov eax, dword [ebp - 0x1a8]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x8a
mov eax, dword [ebp - 0x15c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42f769
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42f769
mov eax, dword [ebp - 0x15c]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x89
mov eax, dword [ebp - 0x1b0]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42f79e
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42f79e
mov eax, dword [ebp - 0x1b0]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x81
mov eax, dword [ebp - 0x164]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42f7d3
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42f7d3
mov eax, dword [ebp - 0x164]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov eax, dword [ebp - 0x74]
push eax
mov ecx, dword [eax - 8]
add ecx, ecx
mov dword [eax - 4], ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0x461514
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x16c]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x8d
mov ecx, dword [ebp - 0x18]
add ecx, 0x318
push ecx
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x8e
lea ecx, [ebp - 0x74]
push eax
call fcn.00408f00
mov byte [ebp - 4], 0x8d
mov eax, dword [ebp - 0x1b8]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42f85a
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42f85a
mov eax, dword [ebp - 0x1b8]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x81
mov eax, dword [ebp - 0x16c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42f88f
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42f88f
mov eax, dword [ebp - 0x16c]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov esi, dword [ebp - 0x74]
push esi
mov eax, dword [esi - 8]
add eax, eax
mov dword [esi - 4], eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov byte [ebp - 4], 0x80
lea eax, [esi - 0x20]
cmp eax, dword [0x476474]
je 0x42f8c8
add esi, 0xffffffe0
or eax, 0xffffffff
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x42f8c8
push esi
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x7f
lea eax, [edi - 0x20]
cmp eax, dword [0x476474]
je 0x42f8f9
lea ecx, [edi - 0x20]
or edi, 0xffffffff
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42f8f1
push ecx
call fcn.004471aa
add esp, 4
mov esi, dword [ebp - 0xb0]
jmp 0x42f902
mov esi, dword [ebp - 0xb0]
or edi, 0xffffffff
lea ecx, [ebp - 0x10a34]
call fcn.004036d0
mov byte [ebp - 4], 0x8f
lea eax, [ebp - 0x20]
push 0x462750
push eax
lea eax, [ebp - 0x1c0]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x90
mov edx, dword [eax]
push 0
mov ecx, dword [edx - 8]
add ecx, ecx
mov dword [edx - 4], ecx
lea ecx, [ebp - 0x10a34]
push dword [eax]
call fcn.00412990
mov dword [ebp + 8], eax
mov byte [ebp - 4], 0x8f
mov ecx, dword [ebp - 0x1c0]
lea edx, [ecx - 0x20]
cmp edx, dword [0x476474]
je 0x42f97b
add ecx, 0xffffffe0
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42f97b
mov eax, dword [ebp - 0x1c0]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
cmp dword [ebp + 8], 0
je 0x42ff98
jmp 0x42f990
push str.desktop
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x42fb2b
lea eax, [ebp - 0x184]
push eax
lea ecx, [ebp - 0x10a34]
call fcn.00414f50
mov byte [ebp - 4], 0x91
lea ecx, [ebp - 0x4c]
push ecx
push eax
lea eax, [ebp - 0x1b4]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x92
push 0x461514
push eax
lea eax, [ebp - 0x17c]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x93
lea ecx, [ebp - 0x78]
push ecx
push eax
lea eax, [ebp - 0x1cc]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x94
push str..lnk
push eax
lea eax, [ebp - 0x1c8]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x95
mov edx, dword [eax]
mov ecx, dword [edx - 8]
add ecx, ecx
mov dword [edx - 4], ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0x94
mov eax, dword [ebp - 0x1c8]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42fa57
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42fa57
mov eax, dword [ebp - 0x1c8]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x93
mov eax, dword [ebp - 0x1cc]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42fa8c
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42fa8c
mov eax, dword [ebp - 0x1cc]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x92
mov eax, dword [ebp - 0x17c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42fac1
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42fac1
mov eax, dword [ebp - 0x17c]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x91
mov eax, dword [ebp - 0x1b4]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42faf6
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42faf6
mov eax, dword [ebp - 0x1b4]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x8f
mov eax, dword [ebp - 0x184]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42fb2b
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42fb2b
mov eax, dword [ebp - 0x184]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
push str.programs
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x42ff85
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x10a34]
call fcn.00414f50
mov byte [ebp - 4], 0x96
lea ecx, [ebp - 0xc0]
push ecx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x97
push 0x461514
push eax
lea eax, [ebp - 0xf8]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x98
mov ecx, dword [ebp - 0x18]
add ecx, 0x318
push ecx
push eax
lea eax, [ebp - 0xf0]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x99
push 0x461514
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x9a
push dword [ebp - 0xc8]
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x9b
push 0x461514
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x9c
lea ecx, [ebp - 0x78]
push ecx
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x9d
push str..lnk
push eax
lea eax, [ebp - 0x1dc]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x9e
mov edx, dword [eax]
mov ecx, dword [edx - 8]
add ecx, ecx
mov dword [edx - 4], ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0x9d
mov eax, dword [ebp - 0x1dc]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42fc53
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42fc53
mov eax, dword [ebp - 0x1dc]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x9c
mov eax, dword [ebp - 0xd4]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42fc88
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42fc88
mov eax, dword [ebp - 0xd4]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x9b
mov eax, dword [ebp - 0xd8]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42fcbd
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42fcbd
mov eax, dword [ebp - 0xd8]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x9a
mov eax, dword [ebp - 0xe0]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42fcf2
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42fcf2
mov eax, dword [ebp - 0xe0]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x99
mov eax, dword [ebp - 0xe8]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42fd27
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42fd27
mov eax, dword [ebp - 0xe8]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x98
mov eax, dword [ebp - 0xf0]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42fd5c
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42fd5c
mov eax, dword [ebp - 0xf0]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x97
mov eax, dword [ebp - 0xf8]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42fd91
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42fd91
mov eax, dword [ebp - 0xf8]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x96
mov eax, dword [ebp - 0x100]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42fdc6
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42fdc6
mov eax, dword [ebp - 0x100]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x8f
mov eax, dword [ebp - 0x108]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42fdfb
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42fdfb
mov eax, dword [ebp - 0x108]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x10a34]
call fcn.00414f50
mov byte [ebp - 4], 0x9f
lea ecx, [ebp - 0xc0]
push ecx
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0xa0
push 0x461514
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00409410
mov byte [ebp - 4], 0xa1
lea ecx, [ebp - 0x78]
push ecx
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0xa2
push str..lnk
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00409410
mov byte [ebp - 4], 0xa3
mov edx, dword [eax]
mov ecx, dword [edx - 8]
add ecx, ecx
mov dword [edx - 4], ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0xa2
mov eax, dword [ebp - 0x110]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42feb1
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42feb1
mov eax, dword [ebp - 0x110]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0xa1
mov eax, dword [ebp - 0x118]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42fee6
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42fee6
mov eax, dword [ebp - 0x118]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0xa0
mov eax, dword [ebp - 0x120]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42ff1b
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42ff1b
mov eax, dword [ebp - 0x120]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x9f
mov eax, dword [ebp - 0x128]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42ff50
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42ff50
mov eax, dword [ebp - 0x128]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x8f
mov eax, dword [ebp - 0x130]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x42ff85
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42ff85
mov eax, dword [ebp - 0x130]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
lea ecx, [ebp - 0x10a34]
call fcn.00413000
test eax, eax
jne 0x42f990
push str.False
lea ecx, [ebp - 0x138]
call fcn.00405580
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 0xa4
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x42fffc
mov edx, dword [ecx + 0x10]
mov eax, dword [ecx + 0x28]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1c], edx
mov dword [ebp + 8], eax
test edx, edx
jle 0x42fffc
lea ecx, [ecx]
push 0x4644c0
push dword [eax]
call fcn.00446ab0
add esp, 8
test eax, eax
mov eax, dword [ebp + 8]
je 0x43019c
mov ecx, dword [ebp - 0x14]
add eax, 8
inc ecx
mov dword [ebp + 8], eax
mov dword [ebp - 0x14], ecx
cmp ecx, dword [ebp - 0x1c]
jl 0x42ffd0
xor ecx, ecx
mov eax, dword [ebp - 0x38]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
setne byte [ebp + 0xb]
mov byte [ebp - 4], 0x8f
mov eax, dword [ebp - 0x138]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x430045
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x430045
mov eax, dword [ebp - 0x138]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
cmp byte [ebp + 0xb], 0
je 0x430162
push str.:__r_n
lea ecx, [ebp - 0x150]
call fcn.004054c0
mov byte [ebp - 4], 0xa5
lea eax, [ebp - 0x78]
push ecx
mov edi, esp
mov dword [ebp + 8], esp
push eax
lea eax, [ebp - 0x150]
push eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.Verkn
call fcn.004054c0
mov byte [ebp - 4], 0xa6
lea eax, [ebp - 0x148]
push eax
mov byte [ebp - 4], 0xa5
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0xa7
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0xa8
push eax
push edi
call fcn.004093a0
mov byte [ebp - 4], 0xa9
mov byte [ebp - 4], 0xa8
mov ecx, dword [ebp - 0x18]
call fcn.00437830
mov byte [ebp - 4], 0xa7
or edi, 0xffffffff
mov eax, dword [ebp - 0x140]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x430101
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x430101
mov eax, dword [ebp - 0x140]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0xa5
mov eax, dword [ebp - 0x148]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x430136
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x430136
mov eax, dword [ebp - 0x148]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x8f
mov eax, dword [ebp - 0x150]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x430162
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x430162
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0x10a34]
call fcn.00406af0
mov byte [ebp - 4], 0x7e
lea eax, [esi - 0x20]
cmp eax, dword [0x476474]
je 0x4301a4
lea ecx, [esi - 0x20]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4301a7
push ecx
call fcn.004471aa
add esp, 4
jmp 0x4301a7
mov ecx, dword [eax + 4]
jmp 0x42fffe
or esi, 0xffffffff
mov byte [ebp - 4], 0x7d
mov eax, dword [ebp - 0x78]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x4301d0
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4301d0
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x7c
mov eax, dword [ebp - 0x158]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x4301fc
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4301fc
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x7b
mov eax, dword [ebp - 0x4c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x430225
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x430225
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x7a
mov eax, dword [ebp - 0xc0]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x430251
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x430251
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0x20]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x43027a
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x43027a
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x16
or edi, 0xffffffff
mov eax, dword [ebp - 0xac]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x4302a9
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4302a9
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x24]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x4302d2
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4302d2
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x14
push dword [ebp - 0x10]
call fcn.0043d220
add esp, 4
mov byte [ebp - 4], 0x13
mov esi, dword [ebp - 0x30]
lea eax, [esi - 0x20]
cmp eax, dword [0x476474]
je 0x43030a
add esi, 0xffffffe0
mov eax, edi
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x43030a
push esi
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x50]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x430333
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x430333
push ecx
call fcn.004471aa
add esp, 4
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x18]
dec edi
mov dword [ebp - 0x28], edi
jns 0x42c960
or edi, 0xffffffff
cmp dword [ebp + 0xc], 0
jne 0x43061d
push ecx
mov eax, esp
mov dword [ebp + 0xc], esp
lea ecx, [esi + 0x31c]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push eax
call fcn.00409520
mov byte [ebp - 4], 0xaa
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x23c]
call fcn.0040f770
push 0x4649c0
lea eax, [esi + 0x254]
push eax
lea eax, [ebp + 8]
push eax
call fcn.00409410
mov byte [ebp - 4], 0xab
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
add ecx, ecx
mov dword [eax - 4], ecx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4304e5
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
add ecx, ecx
mov dword [eax - 4], ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4304e5
mov eax, dword [ebp + 8]
push 4
push 0
mov ecx, dword [eax - 8]
add ecx, ecx
mov dword [eax - 4], ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x461560
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x54], 1
call fcn.004054c0
mov byte [ebp - 4], 0xac
lea eax, [ebp + 8]
push ecx
mov esi, esp
mov dword [ebp - 0x90], esp
push eax
lea eax, [ebp - 0x4c]
push eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
push str.Blockierte_Datei
call fcn.004054c0
mov byte [ebp - 4], 0xad
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0xac
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0xae
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0xaf
push eax
push esi
call fcn.004093a0
mov byte [ebp - 4], 0xb0
mov byte [ebp - 4], 0xaf
mov esi, dword [ebp - 0x18]
mov ecx, esi
call fcn.00437830
mov byte [ebp - 4], 0xae
mov eax, dword [ebp + 0xc]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x43048d
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x43048d
mov eax, dword [ebp + 0xc]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0xac
mov eax, dword [ebp - 0x20]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x4304bc
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4304bc
mov eax, dword [ebp - 0x20]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0xab
mov eax, dword [ebp - 0x4c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x4304e5
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4304e5
push ecx
call fcn.004471aa
add esp, 4
lea eax, [ebp + 8]
push eax
push 0
call fcn.00416880
mov eax, dword [ebp + 8]
add esp, 8
mov ecx, dword [eax - 8]
push 4
add ecx, ecx
push 0
mov dword [eax - 4], ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [esi + 0x254]
push eax
lea ecx, [ebp + 0xc]
call fcn.00405440
mov byte [ebp - 4], 0xb1
cmp dword [esi + 0x1f0], 0
mov esi, dword [ebp + 0xc]
je 0x43053d
mov eax, dword [esi - 8]
add eax, eax
push 0
push esi
mov dword [esi - 4], eax
call fcn.0040f3e0
add esp, 8
push 0x5c
lea ecx, [ebp + 0xc]
call fcn.00428ee0
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x4305c8
mov edi, edi
mov ecx, dword [esi - 8]
push 4
push 0
add ecx, ecx
push esi
mov dword [esi - 4], ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
cmp dword [esi - 0x20], 1
jle 0x43059d
lea ecx, [ebp + 0xc]
call fcn.00427ff0
push dword [esi - 8]
lea ecx, [ebp + 0xc]
call fcn.0040a900
test eax, eax
je 0x43059a
mov eax, dword [esi - 8]
lea eax, [eax*2 + 2]
push eax
push esi
mov esi, dword [ebp + 0xc]
push esi
call fcn.004480a0
add esp, 0xc
jmp 0x43059d
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov dword [esi - 0x14], 0
push esi
mov word [esi + eax*2], cx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
lea ecx, [ebp + 0xc]
mov dword [esi - 8], eax
call fcn.00428ee0
mov dword [ebp - 0x20], eax
test eax, eax
jg 0x430550
mov byte [ebp - 4], 0xab
lea eax, [esi - 0x20]
cmp eax, dword [0x476474]
je 0x4305ee
add esi, 0xffffffe0
mov eax, edi
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x4305ee
push esi
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x43061d
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x43061d
mov eax, dword [ebp + 8]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push 0x46155c
call fcn.00405580
mov byte [ebp - 4], 0xb2
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x18]
mov ecx, esi
call fcn.00437830
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push 0x4642c0
call fcn.00405580
mov byte [ebp - 4], 0xb3
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.00437830
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push 0x46155c
call fcn.00405580
mov byte [ebp - 4], 0xb4
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.00437830
push ecx
mov esi, esp
mov dword [ebp + 8], esp
push 1
push ecx
mov ecx, esp
mov dword [ebp + 0xc], esp
push str.Deinstallation_ist_fast_fertig.
call fcn.004054c0
mov byte [ebp - 4], 0xb5
push esi
mov byte [ebp - 4], 2
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0xb6
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x18]
mov ecx, esi
call fcn.00437830
push dword [esi + 0x298]
call dword [sym.imp.USER32.dll_IsWindow]
push 0
push dword [ebp - 0x84]
push 0x402
push dword [esi + 0x298]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp - 0x54], 0
mov dword [esi + 0x278], 1
je 0x430935
push ecx
mov esi, esp
mov dword [ebp + 8], esp
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x90], esp
push str.Nur_noch_ein_Neustart_des_Computers_durchf
call fcn.004054c0
mov byte [ebp - 4], 0xb7
push esi
mov byte [ebp - 4], 2
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0xb8
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
call fcn.00437830
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push 0x46155c
call fcn.00405580
mov byte [ebp - 4], 0xb9
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
call fcn.00437830
push ecx
mov esi, esp
mov dword [ebp + 8], esp
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x90], esp
push str.Sie_m
call fcn.004054c0
mov byte [ebp - 4], 0xba
push esi
mov byte [ebp - 4], 2
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0xbb
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x18]
mov ecx, esi
call fcn.00437830
push 0x4615dc
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x90], esp
push str.Sie_m
call fcn.004054c0
mov byte [ebp - 4], 0xbc
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 2
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0xbd
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.00409410
mov byte [ebp - 4], 0xbf
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x4307f6
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4307f6
mov eax, dword [ebp + 8]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x90], esp
push str.Soll_der_Computer_jetzt_neu_gestartet_werden_
call fcn.004054c0
mov byte [ebp - 4], 0xc0
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0xbf
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0xc1
lea ecx, [ebp + 0xc]
mov eax, dword [eax]
push eax
push dword [eax - 8]
call fcn.0040ce70
mov byte [ebp - 4], 0xbf
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x430860
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x430860
mov eax, dword [ebp + 8]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
push 0x24
push 1
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push str.Neustart_erforderlich
call fcn.004054c0
mov byte [ebp - 4], 0xc2
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0xbf
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0xc3
mov edx, dword [eax]
mov ecx, dword [edx - 8]
add ecx, ecx
mov dword [edx - 4], ecx
mov edx, dword [eax]
mov eax, dword [ebp + 0xc]
push edx
mov ecx, dword [eax - 8]
add ecx, ecx
mov dword [eax - 4], ecx
push dword [ebp + 0xc]
push dword [esi + 0x27c]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
sete byte [ebp + 0xb]
mov byte [ebp - 4], 0xbf
mov eax, dword [ebp - 0x20]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x4308e9
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4308e9
mov eax, dword [ebp - 0x20]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
cmp byte [ebp + 0xb], 0
je 0x430906
push 1
push 1
call fcn.00435cb0
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 2
mov eax, dword [ebp + 0xc]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x430935
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x430935
mov eax, dword [ebp + 0xc]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x23c]
call fcn.00408bd0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x14]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x430974
add eax, 0xffffffe0
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x430974
mov eax, dword [ebp + 0x14]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, 1
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0x10