Function at 0x405110
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Get common file path
Parse pe header
Resolve function by parsing pe exports
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x53114f
mov eax, dword fs:[0]
push eax
sub esp, 0xda8
mov eax, dword [0x5896f0]
xor eax, esp
mov dword [esp + 0xda0], eax
push ebx
push esi
push edi
mov eax, dword [0x5896f0]
xor eax, esp
push eax
lea eax, [esp + 0xdb8]
mov dword fs:[0], eax
lea eax, [esp + 0xa0]
push eax
mov edi, ecx
mov dword [esp + 0xa4], 8
mov dword [esp + 0xa8], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, edi
call fcn.0041c857
call fcn.0042211a
call dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogOpen_void_]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push 0x55da38
call fcn.0040c030
mov esi, dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
call esi
add esp, 4
lea ecx, [esp + 0x75c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x75c]
movzx eax, word [esp + 0x762]
movzx ecx, word [esp + 0x75e]
push edx
push eax
push ecx
push str._d__d__d
lea edx, [esp + 0xbb4]
push 0x104
push edx
call fcn.0050bb00
add esp, 0x18
lea eax, [esp + 0xba4]
push eax
lea ecx, [esp + 0x20]
call fcn.0040c030
push eax
lea ecx, [esp + 0x54]
push 0x55db0c
push ecx
mov dword [esp + 0xdcc], 0
call fcn.0040c980
add esp, 8
mov edx, esp
mov byte [esp + 0xdc4], 1
mov dword [esp + 0x18], esp
push 0x55db08
push eax
push edx
call fcn.0040c8a0
add esp, 0xc
call esi
mov byte [esp + 0xdc4], 0
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405260
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xdc0], 0xffffffff
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40528b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.0041ae8c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4052a5
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
push 0x55db1c
lea ecx, [esp + 0x1c]
push str.CBootstrapApp::InitInstance_____Bootstrap_app_started._Application_Version___s._n
push ecx
mov dword [esp + 0xdcc], 2
call fcn.0040e740
add esp, 8
lea edx, [esp + 0x1c]
mov dword [esp + 0x18], esp
mov ecx, esp
push edx
call fcn.0040d900
call esi
add esp, 4
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x9a6]
push ecx
mov word [esp + 0x9a8], ax
call fcn.0050d100
add esp, 0xc
push 0x55d38c
lea ecx, [esp + 0x2c]
call fcn.0040c030
lea edx, [esp + 0x99c]
push edx
push 0x104
mov byte [esp + 0xdc8], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
call fcn.0041ae8c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40534f
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x34], eax
mov ecx, 0x55dbdc
mov byte [esp + 0xdc0], 4
test ecx, 0xffff0000
jne 0x405390
mov edx, ecx
movzx ebx, dx
push ebx
call fcn.0041ada7
test eax, eax
je 0x40539e
push ebx
push eax
lea ecx, [esp + 0x3c]
call fcn.0040d790
jmp 0x40539e
push 0x55dbdc
lea ecx, [esp + 0x38]
call fcn.0040c1e0
lea eax, [esp + 0x99c]
push eax
lea ecx, [esp + 0x54]
mov byte [esp + 0xdc4], 5
call fcn.0040c030
mov dword [esp + 0x38], eax
mov byte [esp + 0xdc0], 6
call fcn.0041ae8c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4053dd
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov ecx, str.CBootstrapApp::InitInstance_____Current_working_directory:
mov byte [esp + 0xdc0], 7
test ecx, 0xffff0000
jne 0x40541e
mov edx, ecx
movzx ebx, dx
push ebx
call fcn.0041ada7
test eax, eax
je 0x40542c
push ebx
push eax
lea ecx, [esp + 0x24]
call fcn.0040d790
jmp 0x40542c
push str.CBootstrapApp::InitInstance_____Current_working_directory:
lea ecx, [esp + 0x20]
call fcn.0040c1e0
mov byte [esp + 0xdc0], 8
mov eax, dword [esp + 0x38]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x48]
push edx
call fcn.0040c7e0
add esp, 8
mov ecx, esp
mov byte [esp + 0xdc4], 9
mov dword [esp + 0x18], esp
lea edx, [esp + 0x38]
push edx
push eax
push ecx
call fcn.0040c7e0
add esp, 0xc
call esi
mov byte [esp + 0xdc4], 8
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405495
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 6
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4054bd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 5
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4054e5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 3
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40550d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.00420a03
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x44]
push 0x104
lea ecx, [esp + 0x9a0]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x405a46
push 0x55dbdc
lea ecx, [esp + 0x5c]
call fcn.0040c0f0
mov esi, eax
push 0x55dc1c
lea ecx, [esp + 0x64]
mov byte [esp + 0xdc4], 0xa
call fcn.0040c0f0
mov ebx, eax
push str.CBootstrapApp::InitInstance_____Application_directory_and_command_line:
lea ecx, [esp + 0x38]
mov byte [esp + 0xdc4], 0xb
call fcn.0040c0f0
lea ecx, [esp + 0x99c]
push ecx
push eax
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0xdcc], 0xc
call fcn.0040c8a0
add esp, 0xc
push ebx
push eax
lea eax, [esp + 0x48]
push eax
mov byte [esp + 0xdcc], 0xd
call fcn.0040c7e0
add esp, 0xc
lea ecx, [edi + 0xfc]
push ecx
push eax
lea edx, [esp + 0x40]
mov bl, 0xe
push edx
mov byte [esp + 0xdcc], bl
call fcn.0040c7e0
add esp, 8
mov ecx, esp
mov byte [esp + 0xdc4], 0xf
mov dword [esp + 0x18], esp
push esi
push eax
push ecx
call fcn.0040c7e0
add esp, 0xc
call dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
mov byte [esp + 0xdc4], bl
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40560e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0xd
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405636
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0xc
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40565e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0xb
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405686
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0xa
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4056ae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 3
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4056d6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x99c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
jne 0x4056ec
xor ecx, ecx
jmp 0x405700
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4056f1
sub ecx, esi
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x30]
call fcn.0040de70
push 0x55dbdc
lea ecx, [esp + 0x20]
call fcn.0040c0f0
mov esi, eax
push str.CBootstrapApp::InitInstance_____Application_name:
lea ecx, [esp + 0x44]
mov byte [esp + 0xdc4], 0x10
call fcn.0040c0f0
lea edx, [esp + 0x28]
push edx
push eax
lea eax, [esp + 0x40]
push eax
mov byte [esp + 0xdcc], 0x11
call fcn.0040c7e0
add esp, 8
mov ecx, esp
mov byte [esp + 0xdc4], 0x12
mov dword [esp + 0x18], esp
push esi
push eax
push ecx
call fcn.0040c7e0
mov ebx, dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
add esp, 0xc
call ebx
mov byte [esp + 0xdc4], 0x11
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405798
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x10
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4057c0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 3
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4057e8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x99c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea edx, [esp + 0x99c]
push edx
lea ecx, [esp + 0x54]
call fcn.0040c030
push 0x55dbdc
lea ecx, [esp + 0x20]
mov byte [esp + 0xdc4], 0x13
call fcn.0040c0f0
mov esi, eax
push str.CBootstrapApp::InitInstance_____Setting_current_working_directory_to:
lea ecx, [esp + 0x44]
mov byte [esp + 0xdc4], 0x14
call fcn.0040c0f0
lea ecx, [esp + 0x50]
push ecx
push eax
lea edx, [esp + 0x40]
push edx
mov byte [esp + 0xdcc], 0x15
call fcn.0040c7e0
add esp, 8
mov ecx, esp
mov byte [esp + 0xdc4], 0x16
mov dword [esp + 0x18], esp
push esi
push eax
push ecx
call fcn.0040c7e0
add esp, 0xc
call ebx
mov byte [esp + 0xdc4], 0x15
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405896
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x14
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4058be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x13
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4058e6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea edx, [esp + 0x99c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x55dbdc
lea ecx, [esp + 0x38]
call fcn.0040c0f0
mov esi, eax
lea eax, [esp + 0x99c]
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0xdc4], 0x17
call fcn.0040c030
mov ebx, eax
push str.CBootstrapApp::InitInstance_____New_current_working_directory_is:
lea ecx, [esp + 0x44]
mov byte [esp + 0xdc4], 0x18
call fcn.0040c0f0
push ebx
push eax
lea ecx, [esp + 0x40]
push ecx
mov byte [esp + 0xdcc], 0x19
call fcn.0040c7e0
add esp, 8
mov edx, esp
mov byte [esp + 0xdc4], 0x1a
mov dword [esp + 0x18], esp
push esi
push eax
push edx
call fcn.0040c7e0
add esp, 0xc
call dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
mov byte [esp + 0xdc4], 0x19
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4059a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x18
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4059ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x17
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4059f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x13
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405a1e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 3
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405a46
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x99c]
lea ecx, [edi + 0x100]
lea edx, [eax + 2]
mov si, word [eax]
add eax, 2
test si, si
jne 0x405a56
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x9a0]
push edx
call fcn.0040de70
lea ecx, [esp + 0x28]
call fcn.0040d540
mov ecx, eax
call fcn.0040d5c0
lea ecx, [edi + 0x104]
push eax
call fcn.0040d990
lea ecx, [esp + 0x12c]
call sym.Autorun.exe_public:_void___thiscall_InstallerConfig::constructor_void_
lea ecx, [esp + 0x78]
mov byte [esp + 0xdc0], 0x1b
call dword [sym.imp.BootstrapLibrary.dll_public:_void___thiscall_ConditionChecker::constructor_void_]
lea eax, [esp + 0x3b4]
mov byte [esp + 0xdc0], 0x1c
push eax
lea ecx, [esp + 0x130]
mov byte [esp + 0x54], 0
call dword [sym.imp.BootstrapLibrary.dll_public:_class_CBootstrapConfigItem___thiscall_CBootstrapInit::BootstrapConfigInit_void_]
lea ecx, [edi + 0x114]
mov byte [esp + 0xdc0], 0x1d
push eax
mov dword [esp + 0x90], ecx
call sym.Autorun.exe_public:_class_CBootstrapConfigItem____thiscall_CBootstrapConfigItem::operator_class_CBootstrapConfigItem_const__
lea ecx, [esp + 0x3b4]
mov byte [esp + 0xdc0], 0x1c
call sym.Autorun.exe_public:_void___thiscall_CBootstrapConfigItem::destructor_void_
mov eax, dword [edi + 0x120]
lea ebx, [edi + 0x120]
mov dword [esp + 0x5c], ebx
mov ecx, 0x55d2b0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x405b39
test dx, dx
je 0x405b35
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x405b39
add eax, 4
add ecx, 4
test dx, dx
jne 0x405b13
xor eax, eax
jmp 0x405b3e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x405cb8
mov esi, dword [sym.imp.BootstrapLibrary.dll_public:_int___thiscall_ConditionChecker::getOSMajorVersion_void_]
lea ecx, [esp + 0x78]
call esi
cmp eax, 6
jne 0x405bd6
lea ecx, [esp + 0x78]
call dword [sym.imp.BootstrapLibrary.dll_public:_int___thiscall_ConditionChecker::getOSMinorVersion_void_]
test eax, eax
jne 0x405bd6
lea ecx, [esp + 0x78]
call dword [sym.imp.BootstrapLibrary.dll_public:_enum_SystemArchitectureType___thiscall_ConditionChecker::getOSArchitecture_void_]
cmp eax, 1
jne 0x405bd6
lea ecx, [esp + 0x78]
call dword [sym.imp.BootstrapLibrary.dll_public:_int___thiscall_ConditionChecker::getOSProductType_void_]
cmp eax, 1
jle 0x405bd6
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____Server_2008_x64._Proceeding_with_non_Legacy_Installer._n
call fcn.0040c030
call dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
lea edx, [edi + 0x118]
mov dword [esp + 0x18], esp
mov ecx, esp
push edx
call fcn.0040d900
lea ecx, [esp + 0x130]
call dword [sym.imp.BootstrapLibrary.dll_public:_bool___thiscall_CBootstrapInit::BootstrapInstallerConfigInit_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
lea eax, [esp + 0x284]
push eax
lea ecx, [edi + 0x168]
call sym.Autorun.exe_public:_class_CInstallerConfigItem____thiscall_CInstallerConfigItem::operator_class_CInstallerConfigItem_const__
jmp 0x405d4d
lea ecx, [esp + 0x78]
call esi
cmp eax, 5
jle 0x405bfd
lea ecx, [esp + 0x78]
call dword [sym.imp.BootstrapLibrary.dll_public:_int___thiscall_ConditionChecker::getOSMinorVersion_void_]
test eax, eax
jle 0x405bfd
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____Proceeding_with_non_Legacy_Installer._n
jmp 0x405b94
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____Proceeding_with_Legacy_Installer._n
mov byte [esp + 0x58], 1
call fcn.0040c030
call dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
mov dword [esp + 0x18], esp
mov ecx, esp
push ebx
call fcn.0040d900
lea ecx, [esp + 0x130]
call dword [sym.imp.BootstrapLibrary.dll_public:_bool___thiscall_CBootstrapInit::BootstrapInstallerConfigInit_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
lea ecx, [esp + 0x284]
push ecx
lea ecx, [edi + 0x168]
call fcn.0040d990
lea edx, [esp + 0x288]
lea ecx, [edi + 0x16c]
push edx
call fcn.0040d990
lea eax, [esp + 0x28c]
lea ecx, [edi + 0x170]
push eax
call fcn.0040d990
lea edx, [esp + 0x290]
lea ecx, [edi + 0x174]
push edx
call fcn.0040d990
lea eax, [esp + 0x294]
lea ecx, [edi + 0x178]
push eax
call fcn.0040d990
push 0x55d2b0
push ebx
call fcn.0040ca60
add esp, 8
test al, al
je 0x405e50
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____Issue_loading_or_parsing_Legacy_Config_file._The_bootstrap_application_cannot_continue._n
jmp 0x405d9c
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____Proceeding_with_non_Legacy_Installer._n
call fcn.0040c030
call dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
lea edx, [edi + 0x118]
mov dword [esp + 0x18], esp
mov ecx, esp
push edx
call fcn.0040d900
lea ecx, [esp + 0x130]
call dword [sym.imp.BootstrapLibrary.dll_public:_bool___thiscall_CBootstrapInit::BootstrapInstallerConfigInit_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
lea eax, [esp + 0x284]
push eax
lea ecx, [edi + 0x168]
call fcn.0040d990
lea edx, [esp + 0x288]
lea ecx, [edi + 0x16c]
push edx
call fcn.0040d990
lea eax, [esp + 0x28c]
lea ecx, [edi + 0x170]
push eax
call fcn.0040d990
lea edx, [esp + 0x290]
lea ecx, [edi + 0x174]
push edx
call fcn.0040d990
lea eax, [esp + 0x294]
push eax
lea ecx, [edi + 0x178]
call fcn.0040d990
mov eax, dword [edi + 0x128]
mov ecx, 0x55d2b0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x405d7e
test dx, dx
je 0x405d7a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x405d7e
add eax, 4
add ecx, 4
test dx, dx
jne 0x405d58
xor eax, eax
jmp 0x405d83
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x405e50
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____Issue_loading_or_parsing_Application_config_file._The_bootstrap_application_cannot_continue._n
call fcn.0040c030
call dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
add esp, 4
mov eax, edi
call fcn.00407d70
lea ecx, [esp + 0x78]
mov byte [esp + 0xdc0], 0x1b
call dword [sym.imp.BootstrapLibrary.dll_public:_void___thiscall_ConditionChecker::destructor_void_]
lea ecx, [esp + 0x12c]
mov byte [esp + 0xdc0], 3
call sym.Autorun.exe_public:_void___thiscall_InstallerConfig::destructor_void_
mov byte [esp + 0xdc0], 2
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405dff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0xdc0], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405e2a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0xdb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xda0]
xor ecx, esp
call fcn.0050baf1
mov esp, ebp
pop ebp
ret
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x55db08
call fcn.0040c030
call dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
mov esi, dword [edi + 0x12c]
add esp, 4
mov ecx, 0x55d2b0
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x405e9d
test dx, dx
je 0x405e99
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x405e9d
add eax, 4
add ecx, 4
test dx, dx
jne 0x405e77
xor eax, eax
jmp 0x405ea2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x405edf
mov ecx, str.InstallerhpbcsiInstaller.exe
mov eax, esi
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x405ed6
test dx, dx
je 0x405ed2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x405ed6
add eax, 4
add ecx, 4
test dx, dx
jne 0x405eb0
xor eax, eax
jmp 0x405edb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x405eeb
push 0x55e128
mov ecx, edi
call fcn.0041cb68
call fcn.00420a03
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x48]
lea esi, [edi + 0xfc]
test edx, edx
jne 0x405f04
xor eax, eax
jmp 0x405f1f
mov eax, edx
lea ebx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405f10
sub eax, ebx
sar eax, 1
push eax
push edx
mov ecx, esi
call fcn.0040de70
mov eax, dword [edi + 0x104]
cmp dword [eax - 0xc], 0
jl 0x405f7b
push str.Uninstall.exe
push eax
call fcn.0050c6cd
add esp, 8
test eax, eax
je 0x405f7b
sub eax, dword [edi + 0x104]
sar eax, 1
cmp eax, 0xffffffff
je 0x405f7b
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____Uninstall_by_application_name._n
call fcn.0040c030
call dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
add esp, 4
push 0xb
push str.__Uninstall
mov ecx, esi
call fcn.0040de70
push esi
lea ecx, [esp + 0x30]
call fcn.0040d900
mov byte [esp + 0xdc0], 0x1e
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx - 0xc]
test esi, esi
jns 0x405fa2
push 0x80070057
call fcn.004010a0
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, esi
or eax, ecx
jge 0x405fc1
push esi
lea ecx, [esp + 0x30]
call fcn.0040df50
mov ebx, dword [esp + 0x2c]
lea ecx, [esi + 1]
push ecx
push ebx
call fcn.0050c57c
add esp, 8
cmp esi, dword [ebx - 8]
jg 0x405f98
xor edx, edx
mov dword [ebx - 0xc], esi
mov word [ebx + esi*2], dx
cmp dword [ebx - 0xc], edx
jne 0x406006
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____No_command_line_parameters_detected._n
call fcn.0040c030
call dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
mov esi, dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
add esp, 4
jmp 0x406121
push 0x55dbdc
lea ecx, [esp + 0x38]
call fcn.0040c0f0
mov esi, eax
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0xdc4], 0x1f
call fcn.0040d900
push str.CBootstrapApp::InitInstance_____Bootstrap_command_line:
lea ecx, [esp + 0x20]
mov byte [esp + 0xdc4], 0x20
call fcn.0040c0f0
lea ecx, [esp + 0x38]
push ecx
push eax
lea edx, [esp + 0x48]
push edx
mov byte [esp + 0xdcc], 0x21
call fcn.0040c7e0
add esp, 8
mov ecx, esp
mov byte [esp + 0xdc4], 0x22
mov dword [esp + 0x18], esp
push esi
push eax
push ecx
call fcn.0040c7e0
mov esi, dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
add esp, 0xc
call esi
mov byte [esp + 0xdc4], 0x21
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4060a9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x20
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4060d1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x1f
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4060f9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x1e
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406121
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebx - 0xc], 0
jl 0x4061b1
push str.HELP
push ebx
call fcn.0050c6cd
add esp, 8
test eax, eax
je 0x40614a
sub eax, ebx
sar eax, 1
cmp eax, 0xffffffff
jne 0x40794f
cmp dword [ebx - 0xc], 0
jl 0x4061b1
push 0x55e2cc
push ebx
call fcn.0050c6cd
add esp, 8
test eax, eax
je 0x40616f
sub eax, ebx
sar eax, 1
cmp eax, 0xffffffff
jne 0x40794f
cmp dword [ebx - 0xc], 0
jl 0x4061b1
push str.UNINSTALL
push ebx
call fcn.0050c6cd
add esp, 8
test eax, eax
je 0x406190
sub eax, ebx
sar eax, 1
cmp eax, 0xffffffff
jne 0x4061ba
cmp dword [ebx - 0xc], 0
jl 0x4061b1
push str.FORCEDUNINSTALL
push ebx
call fcn.0050c6cd
add esp, 8
test eax, eax
je 0x4061b1
sub eax, ebx
sar eax, 1
cmp eax, 0xffffffff
jne 0x4061ba
mov byte [edi + 0x10d], 0
jmp 0x4061d7
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____UINSTALL_or_FORCEDUNINSTALL_flag_found_on_the_command_line._n
call fcn.0040c030
call esi
add esp, 4
mov byte [edi + 0x10d], 1
cmp dword [ebx - 0xc], 0
jl 0x406217
push str.SILENT
push ebx
call fcn.0050c6cd
add esp, 8
test eax, eax
je 0x406217
sub eax, ebx
sar eax, 1
cmp eax, 0xffffffff
je 0x406217
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____SILENT_flag_found_on_the_command_line._n
call fcn.0040c030
call esi
add esp, 4
mov byte [edi + 0x10c], 1
jmp 0x40621e
mov byte [edi + 0x10c], 0
cmp dword [ebx - 0xc], 0
jl 0x40625e
push str.DRIVERONLY
push ebx
call fcn.0050c6cd
add esp, 8
test eax, eax
je 0x40625e
sub eax, ebx
sar eax, 1
cmp eax, 0xffffffff
je 0x40625e
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____DRIVERONLY_flag_found_on_the_command_line._n
call fcn.0040c030
call esi
add esp, 4
mov byte [edi + 0x10e], 1
jmp 0x406265
mov byte [edi + 0x10e], 0
cmp dword [ebx - 0xc], 0
jl 0x4067db
push str.HWFIRST
push ebx
call fcn.0050c6cd
add esp, 8
test eax, eax
je 0x40679a
sub eax, ebx
sar eax, 1
cmp eax, 0xffffffff
je 0x40679a
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____HWFIRST_flag_found_on_the_command_line._n
call fcn.0040c030
call dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
add esp, 4
mov byte [edi + 0x111], 1
call fcn.0041ae8c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4062cd
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x58], eax
mov byte [esp + 0xdc0], 0x34
call fcn.0041ae8c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4062ff
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0xdc0], 0x35
call fcn.0041ae8c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x406331
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
push ecx
mov byte [esp + 0xdc4], 0x36
lea edx, [edi + 0x118]
mov dword [esp + 0x18], esp
mov ecx, esp
push edx
call fcn.0040d900
lea eax, [esp + 0x3b8]
push eax
call fcn.00402630
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x3c0]
mov byte [esp + 0xdcc], 0x37
call fcn.00402850
mov ecx, dword [esp + 0x58]
cmp dword [ecx - 0xc], 0
mov esi, dword [esp + 0x20]
je 0x4066f4
cmp dword [esi - 0xc], 0
je 0x4066f4
mov edx, dword [esp + 0x30]
cmp dword [edx - 0xc], 0
je 0x4066f4
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____Parsed_CSI_installer_config_file_to_retrieve_instanceID__path_and_name_of_install_data_file._n
call fcn.0040c030
call dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
add esp, 4
push 0
push 0x55e7f4
lea ecx, [esp + 0x38]
call fcn.0040c2c0
cmp dword [esi - 0xc], 0
jl 0x40646c
push str._ProgramData_
push esi
call fcn.0050c6cd
add esp, 8
test eax, eax
je 0x40646c
sub eax, esi
sar eax, 1
cmp eax, 0xffffffff
je 0x40646c
mov eax, dword [edi + 0x178]
cmp dword [eax - 0xc], 0
lea ecx, [edi + 0x178]
je 0x40646c
push str.true
call fcn.0040c190
cmp dword [eax], 0
je 0x40646c
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____The__ProgramData__string_in_the_path_will_be_replaced_with_the_matching_Windows_app_data_path._n
call fcn.0040c030
call dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
add esp, 4
lea ecx, [esp + 0x76c]
push ecx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea edx, [esp + 0x76c]
push edx
push str._ProgramData_
lea ecx, [esp + 0x28]
call fcn.0040c2c0
push str..xml
lea ecx, [esp + 0x64]
call fcn.0040c0f0
mov esi, eax
push 0x55e930
lea ecx, [esp + 0x38]
mov byte [esp + 0xdc4], 0x38
call fcn.0040c0f0
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0xdcc], 0x39
call fcn.0040c7e0
add esp, 0xc
lea edx, [esp + 0x30]
push edx
push eax
lea eax, [esp + 0x48]
push eax
mov byte [esp + 0xdcc], 0x3a
call fcn.0040c7e0
add esp, 0xc
lea ecx, [esp + 0x58]
push ecx
push eax
lea edx, [esp + 0x40]
push edx
mov byte [esp + 0xdcc], 0x3b
call fcn.0040c7e0
add esp, 0xc
push esi
push eax
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0xdcc], 0x3c
call fcn.0040c7e0
add esp, 0xc
lea ecx, [esp + 0x38]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x40]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x1c]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x34]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x60]
mov byte [esp + 0xdc0], 0x42
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x114]
call fcn.0041df3c
push 0
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0xb4]
mov byte [esp + 0xdcc], 0x43
call fcn.004012f0
mov byte [esp + 0xdc0], 0x44
mov ecx, dword [esp + 0x3c]
push ecx
lea edx, [esp + 0x1c]
push str.CBootstrapApp::InitInstance_____Attempting_to_open_install_data_file:__s._If_present__bootstrap_considers_this_a_relaunch_and_simply_returns._n
push edx
call fcn.0040e740
add esp, 8
mov dword [esp + 0x18], esp
mov ecx, esp
lea eax, [esp + 0x1c]
push eax
call fcn.0040d900
call dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
mov edx, dword [esp + 0x40]
add esp, 4
lea ecx, [esp + 0xa8]
push ecx
push 0
push edx
lea ecx, [esp + 0x120]
call fcn.0041de1a
test eax, eax
je 0x406691
mov eax, dword [esp + 0x3c]
push eax
lea ecx, [esp + 0x1c]
push str.CBootstrapApp::InitInstance_____Opened_file__s._Considering_this_a_relaunch_and_exiting._n
push ecx
call fcn.0040e740
add esp, 8
lea edx, [esp + 0x1c]
mov dword [esp + 0x18], esp
mov ecx, esp
push edx
call fcn.0040d900
call dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
add esp, 4
lea ecx, [esp + 0x114]
call fcn.0041e1dd
mov eax, edi
call fcn.00407d70
lea ecx, [esp + 0xa8]
call fcn.00401400
lea ecx, [esp + 0x114]
mov byte [esp + 0xdc0], 0x42
call fcn.0041e21b
lea ecx, [esp + 0x3c]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea esi, [esp + 0x3b4]
mov byte [esp + 0xdc0], 0x36
call fcn.004027a0
lea ecx, [esp + 0x30]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x20]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x58]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x2c]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x78]
mov byte [esp + 0xdc0], 0x1b
call dword [sym.imp.BootstrapLibrary.dll_public:_void___thiscall_ConditionChecker::destructor_void_]
lea ecx, [esp + 0x12c]
mov byte [esp + 0xdc0], 3
call sym.Autorun.exe_public:_void___thiscall_InstallerConfig::destructor_void_
lea ecx, [esp + 0x28]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x18]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
jmp 0x405e2a
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0x3c]
push eax
push ecx
lea edx, [esp + 0x20]
push str.CBootstrapApp::InitInstance_____Cant_open_file__s__error___u._Not_a_relaunch__continue_executing_bootstrap._n
push edx
call fcn.0040e740
add esp, 0xc
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], esp
mov ecx, esp
push eax
call fcn.0040d900
call dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
add esp, 4
lea ecx, [esp + 0xa8]
call fcn.00401400
lea ecx, [esp + 0x114]
mov byte [esp + 0xdc0], 0x42
call fcn.0041e21b
lea ecx, [esp + 0x3c]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
jmp 0x40670e
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____InstanceID__path_and_name_of_install_data_file_not_found._Continuing_with_bootstrap_execution_as_this_is_a_non_fatal_error._n
call fcn.0040c030
call dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
add esp, 4
lea esi, [esp + 0x3b4]
mov byte [esp + 0xdc0], 0x36
call fcn.004027a0
mov byte [esp + 0xdc0], 0x35
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40674a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x34
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406772
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x1e
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40679a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebx - 0xc], 0
jl 0x4067db
push str.LAUNCHINSTALLER
push ebx
call fcn.0050c6cd
add esp, 8
test eax, eax
je 0x4067db
sub eax, ebx
sar eax, 1
cmp eax, 0xffffffff
je 0x4067db
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____LAUNCHINSTALLER_flag_found_on_the_command_line._n
call fcn.0040c030
call dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
mov byte [edi + 0x113], 1
jmp 0x4067f9
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____LAUNCHINSTALLER_flag_not_found_on_the_command_line._n
call fcn.0040c030
call dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
mov byte [edi + 0x113], 0
add esp, 4
call fcn.00420a03
mov eax, dword [eax + 0xc]
mov dword [edi + 0x1f4], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
movzx ecx, ax
mov edx, ecx
mov eax, ecx
and ecx, 0x3ff
push ecx
and eax, 0xfc00
push eax
push edx
lea edx, [esp + 0x24]
push str.CBootstrapApp::InitInstance_____GetUserDefaultLCID___returned__x__langId0xFC00___x__langId0x3FF___x_n
push edx
call fcn.0040e740
add esp, 0x10
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], esp
mov ecx, esp
push eax
call fcn.0040d900
mov ebx, dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
call ebx
add esp, 4
lea ecx, [esp + 0x78]
call dword [sym.imp.BootstrapLibrary.dll_public:_enum_HPLocalizationLanguageType___thiscall_ConditionChecker::getLanguage_void_]
mov esi, eax
test esi, esi
je 0x406867
cmp esi, 0xf
jne 0x40688e
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____The_language_is_Hebrew_or_Arabic._Setting_flag_to_display_message_boxes_right_to_left._n
call fcn.0040c030
call ebx
add esp, 4
mov dword [edi + 0x1f0], 0x100010
mov byte [edi + 0x110], 1
mov ebx, esi
lea esi, [esp + 0x54]
call fcn.00409680
push 0x55d2ac
lea ecx, [edi + 0x158]
push ecx
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0xdcc], 0x45
call fcn.0040c8a0
add esp, 0xc
push str.hpbcsiBootstrapResources
push eax
lea eax, [esp + 0x48]
push eax
mov byte [esp + 0xdcc], 0x46
call fcn.0040c8a0
add esp, 0xc
lea esi, [edi + 0x108]
push esi
push eax
lea ecx, [esp + 0x40]
push ecx
mov byte [esp + 0xdcc], 0x47
call fcn.0040c7e0
add esp, 0xc
push str..dll
push eax
lea edx, [esp + 0x54]
push edx
mov byte [esp + 0xdcc], 0x48
call fcn.0040c8a0
add esp, 0xc
mov byte [esp + 0xdc0], 0x4a
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406935
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x4b
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40695d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x4c
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406985
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esi]
mov ecx, dword [esp + 0x54]
push esi
push ecx
lea edx, [esp + 0x20]
push str.CBootstrapApp::InitInstance_____GetUserDefaultLCID___returned_user_UI_language___s__Language_ID___s_n
push edx
call fcn.0040e740
add esp, 0xc
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], esp
mov ecx, esp
push eax
call fcn.0040d900
mov esi, dword [sym.imp.BootstrapLibrary.dll_public:_static_bool___cdecl_CBootstrapLog::LogEntry_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
call esi
mov ecx, dword [esp + 0x50]
add esp, 4
push ecx
lea edx, [esp + 0x1c]
push str.CBootstrapApp::InitInstance_____Resource_file___s_n
push edx
call fcn.0040e740
add esp, 8
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], esp
mov ecx, esp
push eax
call fcn.0040d900
call esi
mov ecx, dword [esp + 0x50]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
mov dword [edi + 0x1f8], ebx
test ebx, ebx
jne 0x406a84
mov ebx, dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
lea edx, [esp + 0x20]
push str.CBootstrapApp::InitInstance_____Issue_loading_the_localized_resource_file__s._Last_Error_is:__d.__The_bootstrap_application_cannot_continue._n
push edx
call fcn.0040e740
add esp, 0xc
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], esp
mov ecx, esp
push eax
call fcn.0040d900
call esi
add esp, 4
mov eax, edi
call fcn.00407d70
mov byte [esp + 0xdc0], 0x45
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406a63
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x1e
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x407bba
call fcn.00420a03
lea ecx, [esp + 0x78]
mov dword [eax + 0xc], ebx
call dword [sym.imp.BootstrapLibrary.dll_public:_unsigned_long_long_unsigned___int64____thiscall_ConditionChecker::getTotalRAM_void_]
push edx
push eax
lea ecx, [esp + 0x20]
push str.CBootstrapApp::InitInstance_____Physical_RAM___u._n
push ecx
call fcn.0040e740
add esp, 0xc
lea edx, [esp + 0x1c]
mov dword [esp + 0x18], esp
mov ecx, esp
push edx
call fcn.0040d900
call esi
add esp, 4
push str.CSIBootstrapRunning
lea ecx, [esp + 0x4c]
call fcn.0040c030
mov byte [esp + 0xdc0], 0x4d
call fcn.0041ae8c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x406aef
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0xdc0], 0x4e
call fcn.0041ae8c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x406b21
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x44], eax
mov byte [esp + 0xdc0], 0x4f
call fcn.0041ae8c
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x406b53
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
lea ebx, [edi + 0x130]
push 0x55d2b0
mov ecx, ebx
mov byte [esp + 0xdc4], 0x50
call fcn.0040c270
lea ecx, [esp + 0x20]
test eax, eax
jne 0x406b91
push str.hpbcsiInstaller
call fcn.0040c190
jmp 0x406b97
push ebx
call fcn.0040d990
lea ecx, [esp + 0x78]
call dword [sym.imp.BootstrapLibrary.dll_public:_int___thiscall_ConditionChecker::getOSMajorVersion_void_]
cmp eax, 6
jl 0x406bf7
push str.GlobalCSIBootstrapRunning
lea ecx, [esp + 0x1c]
push str.CBootstrapApp::InitInstance_____Prepending__s._n
push ecx
call fcn.0040e740
add esp, 8
lea edx, [esp + 0x1c]
mov dword [esp + 0x18], esp
mov ecx, esp
push edx
call fcn.0040d900
call esi
add esp, 4
push str.GlobalCSIBootstrapRunning
lea ecx, [esp + 0x4c]
call fcn.0040c190
mov eax, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x24]
push str.Global_s
push ecx
call fcn.0040e740
add esp, 0xc
mov edx, dword [esp + 0x48]
mov ebx, dword [sym.imp.KERNEL32.dll_OpenEventW]
push edx
push 0
push 0x1f0003
call ebx
test eax, eax
je 0x406cd3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x48]
push eax
lea ecx, [esp + 0x1c]
push str.CBootstrapApp::InitInstance_____Bootstrap_is_already_running._User_will_be_notified_before_exiting._OpenEvent_succeeded_on_event_name___s_n
push ecx
call fcn.0040e740
add esp, 8
lea edx, [esp + 0x1c]
mov dword [esp + 0x18], esp
mov ecx, esp
push edx
call fcn.0040d900
call esi
add esp, 4
lea ecx, [esp + 0x50]
call fcn.0040c000
push 0x95
mov byte [esp + 0xdc4], 0x51
call fcn.0041ada7
test eax, eax
je 0x406c74
push 0x95
push eax
lea ecx, [esp + 0x58]
call fcn.0040d790
mov ecx, dword [edi + 0x1f0]
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x50]
push ecx
push edx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, edi
call fcn.00407d70
lea ecx, [esp + 0x50]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x30]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x44]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x20]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x48]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x4c]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x54]
jmp 0x406646
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____Bootstrap_is_not_running._Confirm_that_CSI_is_not_running._n
call fcn.0040c030
call esi
mov eax, dword [esp + 0x24]
add esp, 4
push eax
push 0
push 0x1f0003
call ebx
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____The_application_is_not_running._Creating_an_event_named_CSIBootstrapRunning_to_indicate_that_bootstrap_is_running._n
call fcn.0040c030
call esi
mov ecx, dword [esp + 0x4c]
add esp, 4
push ecx
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 0x1fc], eax
test eax, eax
jne 0x406d56
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [esp + 0x1c]
push str.CBootstrapApp::InitInstance_____Failed_to_create_event_with_call_to_CreateEvent__._This_event_is_used_to_indicate_that_bootstrap_is_running._Proceeding_without_event_creation._Last_error:_d_n
push edx
call fcn.0040e740
add esp, 8
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], esp
mov ecx, esp
push eax
call fcn.0040d900
call esi
add esp, 4
cmp byte [edi + 0x10e], 0
je 0x406d8f
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____The_driveronly_flag_was_detected_on_the_command_line._Launch_the_minimum_driver_install_path._n
call fcn.0040c030
call esi
add esp, 4
mov ecx, edi
mov byte [edi + 0x112], 1
call fcn.00408b70
mov eax, edi
call fcn.00407d70
jmp 0x406c9d
lea ecx, [esp + 0xbc]
call sym.Autorun.exe_public:_void___thiscall_CBootstrapConfigItem::constructor_void_
lea ecx, [esp + 0x24]
call fcn.0040c000
lea ecx, [esp + 0x68]
push ecx
mov byte [esp + 0xdc4], 0x53
call fcn.00402c60
lea ecx, [esp + 0x3c]
call fcn.0040c000
lea ecx, [esp + 0x29c]
mov byte [esp + 0xdc0], 0x55
call dword [sym.imp.BootstrapLibrary.dll_public:_void___thiscall_EvaluateSystem::constructor_void_]
push ecx
mov byte [esp + 0xdc4], 0x56
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____Checking_if_the_Windows_Installer_3.1_version_meets_the_.NET_prereq._n
call fcn.0040c030
call esi
add esp, 4
lea ecx, [esp + 0xbc]
call dword [sym.imp.BootstrapLibrary.dll_public:_bool___thiscall_CBootstrapPrereqCheck::IsWinInstallerInstalled_void_]
push ecx
mov byte [esp + 0x64], al
mov ecx, esp
mov dword [esp + 0x18], esp
test al, al
je 0x406e15
push str.CBootstrapApp::InitInstance_____Windows_Installer_3.1_version_meets_the_.NET_prereq.__n
jmp 0x406e1a
push str.CBootstrapApp::InitInstance_____Windows_Installer_3.1_does_not_meet_the_.NET_prereq._n
call fcn.0040c030
call esi
add esp, 4
push 1
push 0
call fcn.004092a0
test al, al
je 0x406eaf
cmp byte [esp + 0x50], 0
push ecx
mov dword [esp + 0x18], esp
mov ecx, esp
je 0x406ef0
mov ebx, dword [esp + 0x60]
push ebx
call fcn.0040d900
lea ecx, [esp + 0x130]
call dword [sym.imp.BootstrapLibrary.dll_public:_bool___thiscall_CBootstrapInit::BootstrapInstallerConfigInit_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
test al, al
jne 0x406f9f
push ebx
lea edx, [esp + 0x60]
push str.CBootstrapApp::InitInstance_____Issue_loading_or_parsing
push edx
call fcn.0040c980
add esp, 8
mov ecx, esp
mov byte [esp + 0xdc4], 0x57
mov dword [esp + 0x18], esp
push str._file._The_bootstrap_application_cannot_continue._n
push eax
push ecx
call fcn.0040c8a0
add esp, 0xc
call esi
add esp, 4
lea ecx, [esp + 0x5c]
mov byte [esp + 0xdc0], 0x56
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
mov eax, edi
call fcn.00407d70
lea ecx, [esp + 0x29c]
mov byte [esp + 0xdc0], 0x55
call dword [sym.imp.BootstrapLibrary.dll_public:_void___thiscall_EvaluateSystem::destructor_void_]
lea ecx, [esp + 0x3c]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea esi, [esp + 0x68]
call fcn.00402e40
lea ecx, [esp + 0x24]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0xbc]
call sym.Autorun.exe_public:_void___thiscall_CBootstrapConfigItem::destructor_void_
jmp 0x406c9d
lea ebx, [edi + 0x128]
push ebx
call fcn.0040d900
lea ecx, [esp + 0x130]
call dword [sym.imp.BootstrapLibrary.dll_public:_bool___thiscall_CBootstrapInit::BootstrapInstallerConfigInit_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____]
test al, al
jne 0x406f9f
push ebx
lea edx, [esp + 0x60]
push str.CBootstrapApp::InitInstance_____Issue_loading_or_parsing
push edx
call fcn.0040c980
add esp, 8
mov ecx, esp
mov byte [esp + 0xdc4], 0x58
mov dword [esp + 0x18], esp
push str._file._The_bootstrap_application_cannot_continue._n
push eax
push ecx
call fcn.0040c8a0
add esp, 0xc
call esi
add esp, 4
lea ecx, [esp + 0x5c]
mov byte [esp + 0xdc0], 0x56
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
mov eax, edi
call fcn.00407d70
lea ecx, [esp + 0x29c]
mov byte [esp + 0xdc0], 0x55
call dword [sym.imp.BootstrapLibrary.dll_public:_void___thiscall_EvaluateSystem::destructor_void_]
lea ecx, [esp + 0x3c]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea esi, [esp + 0x68]
call fcn.00402e40
lea ecx, [esp + 0x24]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0xbc]
call sym.Autorun.exe_public:_void___thiscall_CBootstrapConfigItem::destructor_void_
jmp 0x406c9d
mov ebx, dword [esp + 0x44]
lea ecx, [esp + 0x78]
call dword [sym.imp.BootstrapLibrary.dll_public:_bool___thiscall_ConditionChecker::isCurrentUserAdmin_void_]
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
test al, al
jne 0x406fef
push str.CBootstrapApp::InitInstance_____User_does_not_have_admin_rights._The_bootstrap_application_cannot_continue._The_user_will_be_notified_in_a_message_box._n
call fcn.0040c030
call esi
add esp, 4
push 0x99
lea ecx, [esp + 0x28]
call fcn.0040c7b0
mov edx, dword [edi + 0x1f0]
mov eax, dword [esp + 0x24]
push edx
push ebx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x406ea8
push str.CBootstrapApp::InitInstance_____User_has_admin_rights__bootstrap_will_continue._n
call fcn.0040c030
call esi
add esp, 4
lea ecx, [esp + 0x12c]
push ecx
lea ecx, [esp + 0x2a0]
call dword [sym.imp.BootstrapLibrary.dll_public:_void___thiscall_EvaluateSystem::SaveSystemConditionItems_class_SystemConditionItems__]
lea edx, [esp + 0x19c]
push edx
lea ecx, [esp + 0x2a0]
call dword [sym.imp.BootstrapLibrary.dll_public:_void___thiscall_EvaluateSystem::SaveSystemCheckConditions_class_SystemCheckConditions__]
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x2a0]
call dword [sym.imp.BootstrapLibrary.dll_public:_bool___thiscall_EvaluateSystem::IsSystemBlocked_class_Condition__]
test al, al
je 0x4070b3
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____The_system_is_blocked._The_user_will_be_notified_in_a_message_box._n
call fcn.0040c030
call esi
add esp, 4
lea ecx, [esp + 0x6c]
call fcn.00409c10
push eax
lea ecx, [esp + 0x28]
call fcn.0040c7b0
mov ecx, dword [edi + 0x1f0]
mov edx, dword [esp + 0x24]
push ecx
push ebx
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [esp + 0x70]
push 0x55d2b0
push eax
call fcn.0040cbf0
add esp, 8
test al, al
je 0x406ea8
mov ecx, dword [esp + 0x70]
push 1
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x406ea8
lea edx, [esp + 0x68]
push edx
lea ecx, [esp + 0x2a0]
call dword [sym.imp.BootstrapLibrary.dll_public:_bool___thiscall_EvaluateSystem::IsSystemSupported_class_Condition__]
test al, al
jne 0x407158
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____The_system_is_not_supported._The_user_will_be_notified_in_a_message_box._n
call fcn.0040c030
call esi
add esp, 4
lea ecx, [esp + 0x6c]
call fcn.00409c10
push eax
lea ecx, [esp + 0x28]
call fcn.0040c7b0
mov eax, dword [edi + 0x1f0]
mov ecx, dword [esp + 0x24]
push eax
push ebx
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea edx, [esp + 0x70]
push 0x55d2b0
push edx
call fcn.0040cbf0
add esp, 8
test al, al
je 0x406ea8
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____The_system_is_not_supported._Trying_to_open_webpage._n
call fcn.0040c030
call esi
add esp, 4
mov eax, dword [esp + 0x70]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x406ea8
mov ecx, dword [edi + 0x160]
push ecx
lea ecx, [esp + 0xc0]
call dword [sym.imp.BootstrapLibrary.dll_public:_bool___thiscall_CBootstrapPrereqCheck::IsDotNet35SPInstalled_int_]
lea ecx, [esp + 0xbc]
mov byte [esp + 0x8b], al
call dword [sym.imp.BootstrapLibrary.dll_public:_bool___thiscall_CBootstrapPrereqCheck::IsOSVista_void_]
cmp byte [esp + 0x8b], 0
jne 0x40719f
test al, al
je 0x40719f
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____For_Vista_.Net_3.51_is_required._The_.NET_prereq_has_not_been_met._n
jmp 0x40736a
lea edx, [esp + 0x68]
push edx
lea ecx, [esp + 0x2a0]
call dword [sym.imp.BootstrapLibrary.dll_public:_bool___thiscall_EvaluateSystem::PrerequisitesMet_class_Condition__]
test al, al
jne 0x4078ef
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____Prerequisites_have_not_been_met._The_user_will_be_notified_in_a_message_box._n
call fcn.0040c030
call esi
add esp, 4
lea ecx, [esp + 0x6c]
call fcn.00409c10
push eax
lea ecx, [esp + 0x28]
call fcn.0040c7b0
push str.TRUE
lea ecx, [esp + 0x288]
call fcn.0040c750
push eax
call fcn.0040ca60
add esp, 8
test al, al
je 0x40732a
push 0
push str.DotNet
lea ecx, [esp + 0x70]
call fcn.0040c710
test eax, eax
jle 0x40732a
lea eax, [edi + 0x148]
push eax
lea ecx, [esp + 0x38]
call fcn.0040d900
lea ecx, [esp + 0x5c]
push ecx
push 0x5602f0
lea edx, [esp + 0x24]
mov byte [esp + 0xdc8], 0x59
push edx
lea ecx, [esp + 0x40]
mov dword [esp + 0x68], 0
call fcn.0040c5e0
xor eax, eax
mov byte [esp + 0xdc0], 0x5a
mov ecx, dword [esp + 0x1c]
push eax
mov dword [esp + 0x770], eax
mov dword [esp + 0x774], eax
mov dword [esp + 0x778], eax
mov dword [esp + 0x77c], eax
mov dword [esp + 0x780], eax
mov dword [esp + 0x784], eax
lea eax, [esp + 0x770]
push eax
push ecx
call fcn.0041e709
test eax, eax
jne 0x407310
mov edx, dword [edi + 0x1f4]
push edx
lea eax, [esp + 0x428]
push eax
call fcn.00411ee0
lea ecx, [esp + 0x424]
mov byte [esp + 0xdc0], 0x5b
call fcn.0041fe7b
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____Dot_Net_not_found___exiting_install._n
call fcn.0040c030
call esi
add esp, 4
mov eax, edi
call fcn.00407d70
lea ecx, [esp + 0x424]
push ecx
mov byte [esp + 0xdc4], 0x5a
call fcn.00407c30
lea ecx, [esp + 0x1c]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x34]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
jmp 0x406eaf
lea ecx, [esp + 0x1c]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x34]
mov byte [esp + 0xdc0], 0x56
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea edx, [esp + 0x74]
push 0x55d2b0
push edx
call fcn.0040cbf0
add esp, 8
test al, al
je 0x406ea8
lea eax, [esp + 0x74]
push str.InstallDotNet
push eax
call fcn.0040ca60
add esp, 8
test al, al
je 0x407868
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.CBootstrapApp::InitInstance_____Prerequisite_Action__Install_DotNet._n
call fcn.0040c030
call esi
add esp, 4
push 1
push ecx
lea edx, [edi + 0x118]
mov dword [esp + 0x1c], esp
mov ecx, esp
push edx
call fcn.0040d900
call fcn.00409e40
test al, al
jne 0x407943
movzx eax, byte [edi + 0x10d]
push 0
push eax
lea ecx, [esp + 0x80]
call dword [sym.imp.BootstrapLibrary.dll_public:_bool___thiscall_ConditionChecker::IsServer2008R2OrLaterServer_void_]
mov edx, dword [esp + 0x68]
movzx ecx, al
mov eax, dword [esp + 0x94]
push ecx
push edx
sub esp, 0x54
mov ecx, esp
mov dword [esp + 0xf4], esp
push eax
call sym.Autorun.exe_public:_void___thiscall_CBootstrapConfigItem::constructor_class_CBootstrapConfigItem_const__
movzx ecx, byte [edi + 0x110]
mov edx, dword [edi + 0x1f4]
push ecx
push edx
lea eax, [esp + 0x490]
push eax
call fcn.0040f850
lea ecx, [esp + 0x424]
mov byte [esp + 0xdc0], 0x5c
call fcn.0041fe7b
lea ecx, [esp + 0x1c]
mov ebx, eax
call fcn.0040c000
lea ecx, [esp + 0x58]
call fcn.0040c000
lea ecx, [esp + 0x34]
call fcn.0040c000
lea ecx, [esp + 0x60]
call fcn.0040c000
push 0x96
lea ecx, [esp + 0x20]
mov byte [esp + 0xdc4], 0x60
call fcn.0040c7b0
push 0x91
lea ecx, [esp + 0x5c]
call fcn.0040c7b0
push 0x93
lea ecx, [esp + 0x38]
call fcn.0040c7b0
push 0x94
lea ecx, [esp + 0x64]
call fcn.0040c7b0
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x68]
push 0x55db08
push edx
call fcn.0040c980
add esp, 0xc
push 0x560728
push eax
lea eax, [esp + 0xa4]
push eax
mov byte [esp + 0xdcc], 0x61
call fcn.0040c8a0
add esp, 0xc
lea ecx, [esp + 0x34]
push ecx
push eax
lea edx, [esp + 0x64]
push edx
mov byte [esp + 0xdcc], 0x62
call fcn.0040c7e0
add esp, 0xc
push 0x560720
push eax
mov byte [esp + 0xdc8], 0x63
lea eax, [esp + 0x94]
push eax
call fcn.0040c8a0
add esp, 0xc
lea ecx, [esp + 0x60]
push ecx
push eax
lea edx, [esp + 0x40]
push edx
mov byte [esp + 0xdcc], 0x64
call fcn.0040c7e0
add esp, 0xc
lea ecx, [esp + 0x8c]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x5c]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x9c]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x64]
mov byte [esp + 0xdc0], 0x69
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
push 0x92
lea ecx, [esp + 0x5c]
call fcn.0040c7b0
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x18]
push 0x55db08
push ecx
call fcn.0040c980
add esp, 0xc
push 0x560728
push eax
lea edx, [esp + 0x98]
push edx
mov byte [esp + 0xdcc], 0x6a
call fcn.0040c8a0
add esp, 0xc
lea ecx, [esp + 0x34]
push ecx
push eax
lea edx, [esp + 0xa0]
push edx
mov byte [esp + 0xdcc], 0x6b
call fcn.0040c7e0
add esp, 0xc
push 0x560720
push eax
lea eax, [esp + 0x9c]
push eax
mov byte [esp + 0xdcc], 0x6c
call fcn.0040c8a0
add esp, 0xc
lea ecx, [esp + 0x60]
push ecx
push eax
lea edx, [esp + 0x48]
push edx
mov byte [esp + 0xdcc], 0x6d
call fcn.0040c7e0
add esp, 0xc
lea ecx, [esp + 0x94]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x98]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x90]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x14]
mov byte [esp + 0xdc0], 0x72
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea eax, [ebx - 2]
cmp eax, 0xc
ja case.0x407602.3
movzx eax, byte [eax + 0x407c14]
jmp dword [eax*4 + 0x407bf8]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push str.CBootstrapApp::InitInstance_____The_user_canceled_the_installation._n
call fcn.0040c030
call esi
add esp, 4
lea ecx, [esp + 0x70]
push 0x55d2b0
push ecx
call fcn.0040cbf0
add esp, 8
test al, al
je case.0x407602.3
lea ecx, [esp + 0x6c]
call fcn.00409c10
push eax
lea ecx, [esp + 0x28]
call fcn.0040c7b0
mov edx, dword [edi + 0x1f0]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [esp + 0x70]
push 1
push 0
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.0x407602.3
lea eax, [edi + 0x134]
push 0x55e128
push eax
call fcn.0040ca60
add esp, 8
test al, al
jne 0x407811
lea ecx, [esp + 0x70]
push 0x55d2b0
push ecx
call fcn.0040cbf0
add esp, 8
test al, al
je case.0x407602.3
lea ecx, [esp + 0x6c]
call fcn.00409c10
push eax
lea ecx, [esp + 0x28]
call fcn.0040c7b0
mov edx, dword [edi + 0x1f0]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [esp + 0x70]
push 1
push 0
push 0
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push str.User_chose_not_to_install_.Net_n
call fcn.0040c030
call esi
add esp, 4
mov eax, edi
call fcn.00407d70
lea ecx, [esp + 0x40]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x38]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x60]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x34]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x58]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x1c]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea eax, [esp + 0x424]
push eax
mov byte [esp + 0xdc4], 0x56
call fcn.00407cd0
jmp 0x406eaf
push ecx
lea edx, [esp + 0x6c]
mov dword [esp + 0x68], esp
mov ecx, esp
push edx
call fcn.0040d900
call fcn.0040be00
test al, al
je case.0x407602.3
mov eax, dword [esp + 0x50]
push eax
mov ebx, edi
call fcn.00407df0
jmp case.0x407602.3
cmp byte [edi + 0x111], 1
jne 0x4077be
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push str..NET_installed_successfully_after_HWFirst._Set_RunOnce._n
call fcn.0040c030
call esi
add esp, 4
mov ecx, edi
call fcn.00409cf0
push 1
push 1
call fcn.004092a0
jmp case.0x407602.3
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push str.CBootstrapApp::InitInstance_____Installation_of_Windows_Installer_3.1_failed._The_user_will_be_notified_in_a_message_box._n
call fcn.0040c030
call esi
mov eax, dword [esp + 0x3c]
jmp 0x4077f9
push ecx
mov ecx, esp
mov dword [esp + 0x68], esp
push str.CBootstrapApp::InitInstance_____Installation_of_.NET_failed._The_user_will_be_notified_in_a_message_box._n
call fcn.0040c030
call esi
mov eax, dword [esp + 0x44]
mov ecx, dword [edi + 0x1f0]
mov edx, dword [esp + 0x20]
add esp, 4
push ecx
push edx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, edi
call fcn.00408b70
lea ecx, [esp + 0x40]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x38]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x60]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x34]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x58]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x1c]
call sym.Autorun.exe_public:_void___thiscall_RebootNow::destructor_void_
lea ecx, [esp + 0x424]
push ecx
mov byte [esp + 0xdc4], 0x56
call fcn.00407cd0
jmp 0x406ea8
lea edx, [esp + 0x74]
push str.LaunchWebpage
push edx
call fcn.0040ca60
add esp, 8
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
test al, al
je 0x4078db
push str.CBootstrapApp::InitInstance_____Prerequisite_Action__Launch_Webpage._n
call fcn.0040c030
call esi
add esp, 4
lea ecx, [esp + 0x6c]
call fcn.00409c10
push eax
lea ecx, [esp + 0x28]
call fcn.0040c7b0
mov eax, dword [edi + 0x1f0]
mov ecx, dword [esp + 0x24]
push eax
push ebx
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea edx, [esp + 0x70]
push 0x55d2b0
push edx
call fcn.0040cbf0
add esp, 8
test al, al
je 0x406ea8
jmp 0x40713b
push str.CBootstrapApp::InitInstance_____Prerequisite_Action_Not_defined._n
call fcn.0040c030
call esi
add esp, 4
jmp 0x406ea8
push 1
push ecx
lea edx, [edi + 0x118]
mov dword [esp + 0x1c], esp
mov ecx, esp
push edx
call fcn.0040d900
call fcn.00409e40
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
test al, al
jne 0x407934
push str.CBootstrapApp::InitInstance_____The_.NET_prereq_has_been_met._Proceed_to_launch_the_installer._n
call fcn.0040c030
call esi
mov eax, dword [esp + 0x54]
add esp, 4
push eax
mov ebx, edi
call fcn.00407df0
jmp 0x406ea8
push str.CBootstrapApp::InitInstance_____The_.NET_prereq_has_been_met._The_user_chose_to_install_driver_only_previously.__Exiting._n
call fcn.0040c030
call esi
add esp, 4
mov ecx, edi
call fcn.0040b7d0
jmp 0x406ea8
push str._n_silent_t_tLaunches_installer_silently_when_used_with_driveronly._Otherwise__suppresses_splash_screen.
lea ecx, [esp + 0x44]
call fcn.0040c0f0
mov esi, eax
push str._ndriveronly_tLaunches_minimum_driver_install._If_used__uninstall_parameter_will_be_ignored.
lea ecx, [esp + 0x3c]
mov byte [esp + 0xdc4], 0x23
call fcn.0040c0f0
mov ebx, eax
push str._nuninstall_t_tLaunches_uninstall.
lea ecx, [esp + 0x60]
mov byte [esp + 0xdc4], 0x24
call fcn.0040c0f0
mov dword [esp + 0x90], eax
push str._n__t_tDisplays_usage_information.
lea ecx, [esp + 0x90]
mov byte [esp + 0xdc4], 0x25
call fcn.0040c0f0
mov dword [esp + 0x14], eax
push str.usage:_nhelp_t_tDisplays_usage_information.
lea ecx, [esp + 0xa0]
mov byte [esp + 0xdc4], 0x26
call fcn.0040c0f0
mov byte [esp + 0xdc0], 0x27
mov ecx, dword [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x6c]
push edx
call fcn.0040c7e0
add esp, 0xc
mov byte [esp + 0xdc0], 0x28
mov ecx, dword [esp + 0x90]
push ecx
push eax
lea edx, [esp + 0x9c]
push edx
call fcn.0040c7e0
add esp, 0xc
push ebx
push eax
lea eax, [esp + 0xa0]
push eax
mov byte [esp + 0xdcc], 0x29
call fcn.0040c7e0
add esp, 0xc
push esi
push eax
lea ecx, [esp + 0x58]
push ecx
mov byte [esp + 0xdcc], 0x2a
call fcn.0040c7e0
add esp, 0xc
mov byte [esp + 0xdc0], 0x2c
mov eax, dword [esp + 0x98]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407a62
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x2d
mov eax, dword [esp + 0x94]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407a8d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x2e
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407ab5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x2f
mov eax, dword [esp + 0x9c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407ae0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x30
mov eax, dword [esp + 0x8c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407b0b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x31
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407b33
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x32
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407b5b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x33
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407b83
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x50]
push 0
push 0x55e128
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, edi
call fcn.00407d70
mov byte [esp + 0xdc0], 0x1e
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x407bc6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xdc0], 0x1c
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405db1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x405db1