Function at 0x4285c0
Capabilities:
Create thread
Delete file
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x469ea0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x46c768
mov esi, ecx
call edi
mov ebx, 1
cmp dword [0x46c5f0], ebx
jne 0x42913d
mov dword [0x46c5f0], 2
mov eax, dword [esi + 0x11c]
mov ecx, dword [eax + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea ecx, [esi + 0x10f0]
call fcn.00413cc0
push 0x45bc70
lea ecx, [esi + 0x181c]
call fcn.0040d1b0
push 0x4596ec
push ebx
push 0xd4
lea ecx, [esi + 0x1ac8]
call fcn.00415b90
push ebx
lea ecx, [esi + 0x1b30]
call fcn.00413cc0
push ebx
lea ecx, [esi + 0x1d04]
call fcn.00413cc0
push 0
lea ecx, [esi + 0x139c]
call fcn.00413cc0
push 0
lea ecx, [esi + 0x1570]
call fcn.00413cc0
push ebx
lea ecx, [esi + 0x2294]
call fcn.00413cc0
push ebx
lea ecx, [esi + 0x2540]
call fcn.00413cc0
push ebx
lea ecx, [esi + 0x2a98]
call fcn.00413cc0
push ebx
lea ecx, [esi + 0x27ec]
call fcn.00413cc0
push ebx
lea ecx, [esi + 0x2ff0]
call fcn.00413cc0
push ebx
lea ecx, [esi + 0x864]
call fcn.00413cc0
push ebx
lea ecx, [esi + 0xa34]
call fcn.00413cc0
push ebx
lea ecx, [esi + 0xc04]
call fcn.00413cc0
push ebx
lea ecx, [esi + 0x2d44]
call fcn.00413cc0
push 0
lea ecx, [esi + 0x3548]
call fcn.00413cc0
push 0
lea ecx, [esi + 0x3ac4]
call fcn.00413cc0
push 0x458f16
lea ecx, [ebp - 0x20]
call fcn.004085c0
call fcn.00438e60
lea ecx, [ebp - 0x20]
test eax, eax
je 0x42871c
push 0x36
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersion_
jmp 0x428723
push 0x2a
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
call fcn.00402c10
push 9
push str.Uninstall
lea ecx, [ebp - 0x20]
call fcn.00422490
push 1
push 0x45b75c
lea ecx, [ebp - 0x20]
call fcn.00422490
mov edx, dword [0x469cb4]
mov eax, dword [edx + 0xc]
mov ecx, 0x469cb4
call eax
mov ebx, 0x10
add eax, ebx
mov ecx, 0x458e24
mov dword [ebp - 0x1c], eax
test ecx, 0xffff0000
jne 0x42878d
mov edx, ecx
movzx edi, dx
push 0
push edi
call fcn.00401340
add esp, 8
test eax, eax
je 0x42879a
push edi
push eax
lea ecx, [ebp - 0x1c]
call fcn.00407a80
jmp 0x42879a
push 0x458e24
lea ecx, [ebp - 0x1c]
call fcn.00402cb0
mov eax, dword [0x46cedc]
cmp dword [0x46cef0], ebx
jae 0x4287ac
mov eax, 0x46cedc
push eax
mov eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
push 0x45bbf8
push ecx
call fcn.00424270
mov edi, dword [0x46ce98]
add esp, 0x10
mov ecx, edi
cmp edi, 4
jb 0x4287d4
mov ecx, 4
mov eax, dword [0x46ce88]
cmp dword [0x46ce9c], ebx
jae 0x4287e6
mov eax, 0x46ce88
push ecx
push 0x45b6ec
push eax
call fcn.00421810
add esp, 0xc
test eax, eax
jne 0x42880c
cmp edi, 4
jb 0x42880c
cmp edi, 4
setne al
test eax, eax
je 0x42893d
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x2c]
push edx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42883f
push eax
push 0x458f16
mov ecx, 0x46ce88
call fcn.0040b3c0
jmp 0x428961
push 1
lea ecx, [esi + 0x371c]
call fcn.00413cc0
push 0x458e24
lea ecx, [ebp - 0x24]
call fcn.00408300
mov eax, dword [0x46cea4]
cmp dword [0x46ceb8], ebx
jae 0x42886b
mov eax, 0x46cea4
cmp dword [0x46c9a8], ebx
mov ebx, dword [0x46c994]
jae 0x42887e
mov ebx, 0x46c994
push eax
lea ecx, [ebp - 0x18]
call fcn.00407e50
push ebx
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.00407e50
mov ecx, dword [edi]
mov edx, dword [eax]
push ecx
push edx
lea eax, [ebp - 0x24]
push 0x45b248
push eax
call fcn.00414da0
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4288c8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4288e7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x458e24
push 0x45bbc0
lea ecx, [ebp - 0x24]
call fcn.00423ea0
mov ebx, dword [ebp - 0x24]
push ebx
lea ecx, [esi + 0x3d70]
call fcn.0040d1b0
push 1
lea ecx, [esi + 0x3d70]
call fcn.00413cc0
lea eax, [ebx - 0x10]
mov dword [esi + 0x38ec], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428961
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x428961
push 0
lea ecx, [esi + 0x371c]
mov dword [esi + 0x38ec], 0
call fcn.00413cc0
push 0
lea ecx, [esi + 0x3d70]
call fcn.00413cc0
push 0x458e24
lea ecx, [ebp - 0x1c]
call fcn.00402cb0
mov eax, dword [0x46cfa0]
mov ebx, 0x10
cmp dword [0x46cfb4], ebx
jae 0x428985
mov eax, 0x46cfa0
mov ecx, dword [ebp - 0x20]
push eax
push ecx
lea edx, [ebp - 0x1c]
push 0x45bbf8
push edx
call fcn.00424270
mov edi, dword [0x46cf5c]
add esp, 0x10
mov ecx, edi
cmp edi, 4
jb 0x4289ad
mov ecx, 4
mov eax, dword [0x46cf4c]
cmp dword [0x46cf60], ebx
jae 0x4289bf
mov eax, 0x46cf4c
push ecx
push 0x45b6ec
push eax
call fcn.00421810
add esp, 0xc
test eax, eax
jne 0x4289e5
cmp edi, 4
jb 0x4289e5
cmp edi, 4
setne al
test eax, eax
je 0x428aea
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x28]
push eax
push 0x20019
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x428a22
push eax
push 0x458f16
mov ecx, 0x46cf4c
call fcn.0040b3c0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x428b0e
push 0x458e24
lea ecx, [ebp - 0x24]
call fcn.00408300
mov eax, dword [0x46cf68]
cmp dword [0x46cf7c], ebx
jae 0x428a41
mov eax, 0x46cf68
push eax
lea ecx, [ebp - 0x18]
call fcn.00407e50
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x24]
push 0x4596dc
push eax
call fcn.00414da0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428a7d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x458e24
push 0x45bbc0
lea ecx, [ebp - 0x24]
call fcn.00423ea0
mov ebx, dword [ebp - 0x24]
push ebx
lea ecx, [esi + 0x401c]
call fcn.0040d1b0
push 1
lea ecx, [esi + 0x401c]
call fcn.00413cc0
push 1
lea ecx, [esi + 0x38f0]
call fcn.00413cc0
lea eax, [ebx - 0x10]
mov dword [esi + 0x3ac0], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428ade
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x428b0e
push 0
lea ecx, [esi + 0x38f0]
mov dword [esi + 0x3ac0], 0
call fcn.00413cc0
push 0
lea ecx, [esi + 0x401c]
call fcn.00413cc0
mov edi, dword [0x46970c]
mov eax, edi
cmp edi, 6
jb 0x428b20
mov eax, 6
cmp dword [0x469710], 0x10
mov ecx, dword [0x4696fc]
jae 0x428b34
mov ecx, 0x4696fc
push eax
push 0x45bbf0
push ecx
call fcn.00421810
mov ebx, dword [0x46d18c]
add esp, 0xc
test eax, eax
jne 0x428c3f
cmp edi, 6
jb 0x428c3f
xor eax, eax
cmp edi, 6
setne al
test eax, eax
jne 0x428c3f
mov ecx, ebx
cmp ebx, 1
jb 0x428b74
lea ecx, [eax + 1]
mov eax, dword [0x46d17c]
mov edi, 0x10
cmp dword [0x46d190], edi
jae 0x428b8b
mov eax, 0x46d17c
push ecx
push 0x45bbec
push eax
call fcn.00421810
add esp, 0xc
test eax, eax
jne 0x428c3f
cmp ebx, 1
jb 0x428c49
cmp ebx, 1
setne al
test eax, eax
jne 0x428c3f
mov eax, dword [0x46d1b4]
cmp dword [0x46d1c8], edi
jae 0x428bcb
mov eax, 0x46d1b4
push eax
lea ecx, [ebp - 0x18]
call fcn.00407e50
mov edx, dword [eax]
push edx
lea ecx, [esi + 0x516c]
call fcn.0040d1b0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428c01
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xffffffffffffffff
push 0
push 0x46d1ec
mov ecx, 0x46d10c
call fcn.0040a550
push 0xffffffffffffffff
push 0
push 0x46d1d0
mov ecx, 0x46d128
call fcn.0040a550
push 0xffffffffffffffff
push 0
push 0x46d208
mov ecx, 0x46d144
call fcn.0040a550
jmp 0x428f89
mov edi, 0x10
cmp ebx, 1
jae 0x428c4d
mov ecx, ebx
jmp 0x428c52
mov ecx, 1
mov eax, dword [0x46d17c]
cmp dword [0x46d190], edi
jae 0x428c64
mov eax, 0x46d17c
push ecx
push 0x45bbec
push eax
call fcn.00421810
add esp, 0xc
test eax, eax
jne 0x428e60
cmp ebx, 1
jb 0x428e60
cmp ebx, 1
setne al
test eax, eax
jne 0x428e60
push 0x458e24
lea ecx, [ebp - 0x1c]
call fcn.00402cb0
mov eax, dword [0x46d198]
cmp dword [0x46d1ac], edi
jae 0x428cb1
mov eax, 0x46d198
mov ecx, dword [ebp - 0x20]
push eax
push ecx
lea edx, [ebp - 0x1c]
push 0x45bbf8
push edx
call fcn.00424270
mov ecx, dword [ebp - 0x1c]
add esp, 0x10
lea eax, [ebp - 0x28]
push eax
push 0x20019
push 0
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x428d36
mov eax, dword [0x46d1b4]
cmp dword [0x46d1c8], edi
jae 0x428cf7
mov eax, 0x46d1b4
push eax
lea ecx, [ebp - 0x18]
call fcn.00407e50
mov edx, dword [eax]
push edx
lea ecx, [esi + 0x516c]
call fcn.0040d1b0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x428dd0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x428dd0
mov eax, dword [0x46d10c]
cmp dword [0x46d120], edi
jae 0x428d48
mov eax, 0x46d10c
push 0
push 0x458f16
push eax
call fcn.00421810
add esp, 0xc
test eax, eax
jne 0x428d69
cmp dword [0x46d11c], eax
setne al
test eax, eax
je 0x428d9f
mov eax, dword [0x46d0f0]
cmp dword [0x46d104], edi
jae 0x428d7b
mov eax, 0x46d0f0
push eax
lea ecx, [ebp - 0x18]
call fcn.00407e50
mov ecx, dword [eax]
push ecx
lea ecx, [esi + 0x516c]
call fcn.0040d1b0
lea ecx, [ebp - 0x18]
call fcn.00402220
jmp 0x428e2d
mov eax, dword [0x46d1b4]
cmp dword [0x46d1c8], edi
jae 0x428db1
mov eax, 0x46d1b4
push eax
lea ecx, [ebp - 0x18]
call fcn.00407e50
mov edx, dword [eax]
push edx
lea ecx, [esi + 0x516c]
call fcn.0040d1b0
lea ecx, [ebp - 0x18]
call fcn.00402220
push 0xffffffffffffffff
push 0
push 0x46d1ec
mov ecx, 0x46d10c
call fcn.0040a550
push 0xffffffffffffffff
push 0
push 0x46d1d0
mov ecx, 0x46d128
call fcn.0040a550
push 0xffffffffffffffff
push 0
push 0x46d208
mov ecx, 0x46d144
call fcn.0040a550
push 1
lea ecx, [esi + 0x516c]
call fcn.00413cc0
push 1
lea ecx, [esi + 0x4f98]
call fcn.00413cc0
mov dword [esi + 0x5168], 1
push 1
lea ecx, [esi + 0x516c]
call fcn.00413cc0
push 1
lea ecx, [esi + 0x4f98]
call fcn.00413cc0
mov eax, dword [ebp - 0x28]
push eax
mov dword [esi + 0x5168], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x428fad
mov eax, dword [0x46d10c]
cmp dword [0x46d120], edi
jae 0x428e72
mov eax, 0x46d10c
push 0
push 0x458f16
push eax
call fcn.00421810
add esp, 0xc
test eax, eax
jne 0x428e93
cmp dword [0x46d11c], eax
setne al
test eax, eax
je 0x428ee4
mov eax, dword [0x46d0f0]
cmp dword [0x46d104], edi
jae 0x428ea5
mov eax, 0x46d0f0
push eax
lea ecx, [ebp - 0x18]
call fcn.00407e50
mov ecx, dword [eax]
push ecx
lea ecx, [esi + 0x516c]
call fcn.0040d1b0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x428f89
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x428f89
mov eax, dword [0x46d1b4]
cmp dword [0x46d1c8], edi
jae 0x428ef6
mov eax, 0x46d1b4
push eax
lea ecx, [ebp - 0x18]
call fcn.00407e50
mov ecx, dword [eax]
push ecx
lea ecx, [esi + 0x516c]
call fcn.0040d1b0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x428f2c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0xffffffffffffffff
push 0
push 0x46d1ec
mov ecx, 0x46d10c
call fcn.0040a550
push 0xffffffffffffffff
push 0
push 0x46d1d0
mov ecx, 0x46d128
call fcn.0040a550
push 0xffffffffffffffff
push 0
push 0x46d208
mov ecx, 0x46d144
call fcn.0040a550
push 1
lea ecx, [esi + 0x516c]
call fcn.00413cc0
push 1
lea ecx, [esi + 0x4f98]
call fcn.00413cc0
mov dword [esi + 0x5168], 1
push 1
lea ecx, [esi + 0x516c]
call fcn.00413cc0
push 1
lea ecx, [esi + 0x4f98]
call fcn.00413cc0
mov dword [esi + 0x5168], 1
push 0x458e24
lea ecx, [ebp - 0x1c]
call fcn.00402cb0
mov eax, dword [0x46d064]
mov ebx, 0x10
cmp dword [0x46d078], ebx
jae 0x428fd1
mov eax, 0x46d064
mov ecx, dword [ebp - 0x20]
push eax
push ecx
lea edx, [ebp - 0x1c]
push 0x45bbf8
push edx
call fcn.00424270
mov edi, dword [0x46d020]
add esp, 0x10
mov ecx, edi
cmp edi, 4
jb 0x428ff9
mov ecx, 4
mov eax, dword [0x46d010]
cmp dword [0x46d024], ebx
jae 0x42900b
mov eax, 0x46d010
push ecx
push 0x45b6ec
push eax
call fcn.00421810
mov ebx, dword [ebp - 0x1c]
add esp, 0xc
test eax, eax
jne 0x429036
cmp edi, 4
jb 0x429036
xor eax, eax
cmp edi, 4
setne al
test eax, eax
je 0x4290d5
lea eax, [ebp - 0x2c]
push eax
push 0x20019
push 0
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x429066
push eax
push 0x458f16
mov ecx, 0x46d010
call fcn.0040b3c0
jmp 0x4290f9
cmp dword [0x46d040], 0x10
mov eax, dword [0x46d02c]
jae 0x429079
mov eax, 0x46d02c
push eax
lea ecx, [ebp - 0x18]
call fcn.00407e50
mov ecx, dword [eax]
push ecx
lea ecx, [esi + 0x42c8]
call fcn.0040d1b0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4290af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 1
lea ecx, [esi + 0x42c8]
call fcn.00413cc0
push 1
lea ecx, [esi + 0x4dc4]
call fcn.00413cc0
mov dword [esi + 0x4f94], 1
jmp 0x4290f9
push 0
lea ecx, [esi + 0x4dc4]
mov dword [esi + 0x4f94], 0
call fcn.00413cc0
push 0
lea ecx, [esi + 0x42c8]
call fcn.00413cc0
lea eax, [ebx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x429115
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4293f4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x4293f4
mov dword [0x46c5f0], 3
cmp dword [esi + 0x120], 0
jne 0x42920b
lea ecx, [ebp - 0x14]
push ecx
mov ecx, esi
call fcn.00421a90
mov eax, dword [ebp - 0x14]
add eax, 0x1e
mov dword [ebp - 0x14], eax
add eax, 0x21a
push 0x6c
mov dword [ebp - 0xc], eax
call fcn.0043f1c7
add esp, 4
test eax, eax
je 0x429187
mov ecx, eax
call fcn.004090c0
jmp 0x429189
xor eax, eax
mov dword [esi + 0x120], eax
push 0
push ecx
mov eax, esp
mov dword [eax], 0
cmp dword [0x46caf8], 0x10
mov eax, dword [0x46cae4]
jae 0x4291ad
mov eax, 0x46cae4
push eax
lea ecx, [ebp - 0x18]
call fcn.00407e50
mov eax, dword [eax]
push 0
push 0x90100000
push eax
push ecx
mov eax, esp
lea edx, [ebp - 0x14]
mov dword [eax], edx
mov eax, dword [esi + 4]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [esi + 0x120]
call fcn.00425cf0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4291f9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esi + 0x120]
mov edx, dword [ecx + 4]
mov ecx, dword [esi + 4]
push edx
call fcn.004109e0
push 0
lea ecx, [esi + 0x4c4]
mov dword [esi + 0x4574], ebx
call fcn.00413cc0
lea ecx, [esi + 0x1ac8]
call fcn.00415900
push 0
lea ecx, [esi + 0x2a98]
call fcn.00413cc0
push 0
lea ecx, [esi + 0x181c]
call fcn.00413cc0
push 0
lea ecx, [esi + 0x694]
call fcn.00413cc0
lea ecx, [esi + 0xddc]
call fcn.00415900
push 0
lea ecx, [esi + 0xe44]
call fcn.00413cc0
push 0
lea ecx, [esi + 0x864]
call fcn.00413cc0
push 0
lea ecx, [esi + 0xa34]
call fcn.00413cc0
push 0
lea ecx, [esi + 0xc04]
call fcn.00413cc0
lea eax, [esi + 0x47a0]
push eax
call edi
lea ecx, [esi + 0x49a8]
push ecx
call edi
lea edx, [esi + 0x4bb0]
push edx
call edi
lea eax, [esi + 0x4598]
push eax
call edi
push 0
lea ecx, [esi + 0x2294]
call fcn.00413cc0
push 0
lea ecx, [esi + 0x2540]
call fcn.00413cc0
push 0
lea ecx, [esi + 0x2ff0]
call fcn.00413cc0
push 0
lea ecx, [esi + 0x2d44]
call fcn.00413cc0
push 0
lea ecx, [esi + 0x38f0]
call fcn.00413cc0
push 0
lea ecx, [esi + 0x401c]
call fcn.00413cc0
push ebx
lea ecx, [esi + 0x371c]
call fcn.00413cc0
push ebx
lea ecx, [esi + 0x3d70]
call fcn.00413cc0
push 0
lea ecx, [esi + 0x3548]
call fcn.00413cc0
push 0
lea ecx, [esi + 0x3ac4]
call fcn.00413cc0
push 0
lea ecx, [esi + 0x42c8]
call fcn.00413cc0
push ebx
lea ecx, [esi + 0x1fb0]
call fcn.00413cc0
push ebx
lea ecx, [esi + 0x329c]
call fcn.00413cc0
push 5
mov ecx, dword [esi + 0x120]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
lea ecx, [esi + 0x5418]
call fcn.00413cc0
push ebx
lea ecx, [esi + 0x5ec8]
call fcn.00413cc0
push 0
lea ecx, [esi + 0x516c]
call fcn.00413cc0
push 0
lea ecx, [esi + 0x4f98]
call fcn.00413cc0
push ebx
lea ecx, [esi + 0x6174]
call fcn.00413cc0
push 0
lea ecx, [esi + 0x4dc4]
call fcn.00413cc0
push 0
lea ecx, [esi + 0x42c8]
call fcn.00413cc0
push ebx
lea ecx, [esi + 0x56c4]
call fcn.00413cc0
push 0
push 0
push 0
push 0x421f20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x9c4
push 0x80d
mov ecx, esi
call fcn.004117f0
push 0
mov ecx, esi
call fcn.00412b40
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0043eb21
mov esp, ebp
pop ebp
ret 0x10