Function at 0x415540
Capabilities:
Create directory
Create process on windows
Create thread
Delete directory
Delete file
Get session user name
Print debug messages
Read .ini file
Self delete

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1bd4
call fcn.0042d2e0
mov eax, dword [0x44c044]
xor eax, esp
mov dword [esp + 0x1bd0], eax
push ebx
push esi
push edi
push 0x220
push 0
push 0x47bb20
call fcn.00428490
add esp, 0xc
push 0x44d964
push 0x4904f0
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x4904ec], eax
mov eax, dword [ebp + 0x10]
mov edx, 0x48eb90
sub edx, eax
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4155a0
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push str.C:TempwmcInst.ini
push 0
push str.Time
push 0x443f08
call esi
push str.C:TempwmcInst.ini
push 0
push 0x443f14
push 0x443f08
mov dword [0x48ba88], eax
call esi
mov dword [0x48ba8c], eax
mov eax, dword [ebp + 8]
mov dword [0x48cee8], eax
mov eax, 0x48eb90
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4155f5
sub eax, edx
sar eax, 1
je 0x415c3c
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push str._ManualUpdate__Elevate_CmdLine_
call edi
mov esi, 0x48eb90
call fcn.0040d300
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0xb7a]
push edx
mov dword [esp + 0x1c], 0
mov word [esp + 0xb7c], cx
call fcn.00428490
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0xb70]
push str._C:Program_FilesWW2017CFwmcSystem7.exe___ap
push eax
call ebx
push str._apmode2
call fcn.00403ca0
add esp, 0xc
cmp eax, 1
jne 0x4156c4
lea ecx, [esp + 0xb70]
push ecx
lea ecx, [esp + 0x14]
call fcn.00405ee0
mov edx, dword [esp + 0x14]
add esp, 4
push edx
push eax
lea eax, [esp + 0xb78]
push eax
push 0x443fd8
push 0x48f198
call ebx
add esp, 0x14
push 0x48f198
call edi
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1bd0]
xor ecx, esp
call fcn.004217e4
mov esp, ebp
pop ebp
ret 0x10
push str._apmode3
call fcn.00403ca0
add esp, 4
cmp eax, 1
jne 0x4156ff
lea ecx, [esp + 0xb70]
push ecx
lea ecx, [esp + 0x14]
call fcn.00406370
mov edx, dword [esp + 0x14]
add esp, 4
push edx
push eax
lea eax, [esp + 0xb78]
push eax
push 0x444038
jmp 0x415697
push str._apmode4
call fcn.00403ca0
add esp, 4
cmp eax, 1
jne 0x41573d
lea ecx, [esp + 0xb70]
push ecx
lea ecx, [esp + 0x14]
call fcn.00406370
mov edx, dword [esp + 0x14]
add esp, 4
push edx
push eax
lea eax, [esp + 0xb78]
push eax
push 0x444098
jmp 0x415697
push str._apmode1
call fcn.00403ca0
add esp, 4
cmp eax, 1
jne 0x4157ed
push 0x44
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.00428490
add esp, 0xc
xor eax, eax
lea edx, [esp + 0x60]
push edx
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [esp + 0xb90]
push ecx
push 0
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [esp + 0x68]
mov esi, eax
mov eax, dword [esp + 0x64]
test eax, eax
je 0x4157bf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x60]
test eax, eax
je 0x4157ce
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push esi
lea edx, [esp + 0xb78]
push edx
push 0x4440f8
push 0x48f198
call dword [sym.imp.USER32.dll_wsprintfW]
jmp 0x41569e
push str._unrar
call fcn.00403ca0
add esp, 4
cmp eax, 1
jne 0x415942
cmp dword [0x48ba94], 0
jne 0x415942
push str.wmcInst.exe_Command_to_Write_Package_File.
call edi
call fcn.00402060
mov ecx, eax
or ecx, edx
mov dword [0x4906f8], eax
mov dword [0x4906fc], edx
jne 0x415845
push 0x10
push 0x43bdf4
push str._qL_eQ
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x417251
mov edx, dword [0x490700]
lea esi, [eax + edx + 0x10]
xor eax, eax
mov ecx, 0x36
lea edi, [esp + 0x70]
rep movsd dword es:[edi], dword [esi]
push 0x206
push eax
lea ecx, [esp + 0x76a]
push ecx
mov word [esp + 0x76c], ax
call fcn.00428490
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x152]
push eax
mov word [esp + 0x154], dx
call fcn.00428490
add esp, 0xc
push 0x104
lea ecx, [esp + 0x764]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x760]
push 0x5c
push edx
call fcn.0042224c
add esp, 8
test eax, eax
je 0x4158dc
lea eax, [esp + 0x760]
push 0x5c
push eax
call fcn.0042224c
add esp, 8
xor ecx, ecx
mov word [eax], cx
xor esi, esi
lea edi, [esp + 0x70]
cmp dword [edi], 0
je 0x415925
mov edx, dword [esi*4 + 0x44e414]
push edx
lea eax, [esp + 0x764]
push eax
lea ecx, [esp + 0x150]
push str._ls_s
push ecx
call ebx
mov edx, dword [0x4906fc]
mov eax, dword [0x4906f8]
push edx
push eax
lea ecx, [esp + 0x160]
push ecx
mov ecx, esi
call fcn.004024f0
add esp, 0x1c
inc esi
add edi, 0x18
cmp esi, 9
jl 0x4158e2
mov edx, dword [0x490700]
push edx
call fcn.004217f3
add esp, 4
jmp 0x4156a8
push str._add
call fcn.00403ca0
add esp, 4
cmp eax, 1
jne 0x415ba5
cmp dword [0x48ba94], 0
jne 0x415ba5
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x152]
push ecx
mov word [esp + 0x154], ax
call fcn.00428490
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0xd82]
push eax
mov word [esp + 0xd84], dx
call fcn.00428490
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x562]
push edx
mov word [esp + 0x564], cx
call fcn.00428490
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x76a]
push ecx
mov word [esp + 0x76c], ax
call fcn.00428490
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x35a]
push eax
mov word [esp + 0x35c], dx
call fcn.00428490
add esp, 0xc
push 0x104
lea ecx, [esp + 0x14c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x148]
mov word [esp + eax + 0xd78], cx
add eax, 2
test cx, cx
jne 0x415a20
lea edx, [esp + 0xd78]
push 0x5c
push edx
call fcn.0042224c
add esp, 8
test eax, eax
je 0x415a65
lea eax, [esp + 0xd78]
push 0x5c
push eax
call fcn.0042224c
add esp, 8
xor ecx, ecx
mov word [eax], cx
xor eax, eax
jmp 0x415a70
movzx ecx, word [esp + eax + 0xd78]
mov word [esp + eax + 0x760], cx
add eax, 2
test cx, cx
jne 0x415a70
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [esp + eax + 0xd78]
mov word [esp + eax + 0x350], cx
add eax, 2
test cx, cx
jne 0x415a90
lea edx, [esp + 0x760]
push 0x5c
push edx
call fcn.0042224c
add eax, 2
lea edx, [esp + 0x560]
add esp, 8
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x415ac6
lea eax, [esp + 0x558]
push 0x28
push eax
call fcn.0042224c
add esp, 8
test eax, eax
je 0x415b16
push 4
push 0x4441d8
push eax
call fcn.004243f6
add esp, 0xc
test eax, eax
jne 0x415b16
lea ecx, [esp + 0x558]
push 0x28
push ecx
call fcn.0042224c
add esp, 8
xor edx, edx
mov word [eax], dx
lea eax, [esp + 0x350]
push 0x5c
push eax
call fcn.0042224c
add esp, 8
test eax, eax
je 0x415b43
lea ecx, [esp + 0x350]
push 0x5c
push ecx
call fcn.0042224c
add esp, 8
xor edx, edx
mov word [eax], dx
lea eax, [esp + 0x558]
push eax
lea ecx, [esp + 0x354]
push ecx
lea edx, [esp + 0x768]
push str._s_s.exe
push edx
call ebx
add esp, 0x10
lea esi, [esp + 0x760]
lea eax, [esp + 0x148]
call fcn.0040d280
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
push eax
call fcn.00402940
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1bd0]
xor ecx, esp
call fcn.004217e4
mov esp, ebp
pop ebp
ret 0x10
push str._rar
call fcn.00403ca0
add esp, 4
cmp eax, 1
jne 0x415bdc
cmp dword [0x48ba94], 0
jne 0x415bdc
call fcn.00401420
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1bd0]
xor ecx, esp
call fcn.004217e4
mov esp, ebp
pop ebp
ret 0x10
push str._SmrInstallTerminate_
call fcn.00403ca0
add esp, 4
cmp eax, 1
jne 0x415c0a
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str._wmcInst___Install_terminate___Clear_Temp_
call edi
call fcn.00412560
jmp 0x4156a8
push str._SmrInstallSuccess_
call fcn.00403ca0
add esp, 4
cmp eax, 1
jne 0x417251
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str._wmcInst__Install_Success__Clear_Temp_
call edi
call fcn.00412560
jmp 0x4156a8
call fcn.00402060
mov dword [0x4906f8], eax
mov dword [0x4906fc], edx
test edx, edx
jne 0x415c54
test eax, eax
je 0x415c6a
mov ecx, dword [0x490700]
lea esi, [eax + ecx + 0x10]
mov ecx, 0x36
mov edi, 0x490708
rep movsd dword es:[edi], dword [esi]
call fcn.00414400
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x139a]
push eax
mov word [esp + 0x139c], dx
call fcn.00428490
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [esp + 0x1390]
push str.C:UsersPublicSMR7
push ecx
call ebx
mov esi, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
add esp, 8
push 0
lea edx, [esp + 0x1394]
push edx
push 0
call esi
call fcn.00412590
test eax, eax
jne 0x415dc8
push 0x206
push eax
lea ecx, [esp + 0x152]
push ecx
mov word [esp + 0x154], ax
call fcn.00428490
add esp, 0xc
lea edx, [esp + 0x148]
push str.C:UsersPublicSMR7DebugInitialFailLog
push edx
call ebx
add esp, 8
push 0
lea eax, [esp + 0x14c]
push eax
push 0
call esi
lea ecx, [esp + 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x35a]
push eax
mov word [esp + 0x35c], dx
call fcn.00428490
add esp, 0xc
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x562]
push edx
mov word [esp + 0x564], cx
call fcn.00428490
add esp, 0xc
push 0x104
lea eax, [esp + 0x354]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx ecx, word [esp + 0x66]
movzx edx, word [esp + 0x62]
movzx eax, word [esp + 0x60]
push ecx
push edx
push eax
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x360]
push edx
lea eax, [esp + 0x56c]
push str._c_echo____date_____time_____s___Initial_Path_Fail________sFailLog__04u__02u__02u.log_
push eax
call ebx
add esp, 0x1c
push 5
push 0
lea ecx, [esp + 0x560]
push ecx
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x417251
call fcn.00412b80
test eax, eax
jne 0x415eba
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x152]
push eax
mov word [esp + 0x154], dx
call fcn.00428490
add esp, 0xc
lea ecx, [esp + 0x148]
push str.C:UsersPublicSMR7DebugInitialFailLog
push ecx
call ebx
add esp, 8
push 0
lea edx, [esp + 0x14c]
push edx
push 0
call esi
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x35a]
push edx
mov word [esp + 0x35c], cx
call fcn.00428490
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x562]
push ecx
mov word [esp + 0x564], ax
call fcn.00428490
add esp, 0xc
push 0x104
lea edx, [esp + 0x354]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx eax, word [esp + 0x66]
movzx ecx, word [esp + 0x62]
movzx edx, word [esp + 0x60]
push eax
push ecx
push edx
lea eax, [esp + 0x154]
push eax
lea ecx, [esp + 0x360]
push ecx
lea edx, [esp + 0x56c]
push str._c_echo____date_____time_____s___Test_Write_Log_Fail________sFailLog__04u__02u__02u.log_
push edx
call ebx
add esp, 0x1c
push 5
push 0
lea eax, [esp + 0x560]
push eax
jmp 0x415da6
push str.GlobalwmcInst.exe
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov dword [0x4906f4], eax
test eax, eax
jne 0x41722c
push str.GlobalwmcInst.exe
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x4906f4], eax
test eax, eax
jne 0x415f23
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x4904ec]
push eax
push ecx
push 0x4904f0
push 0x4444d0
push 0x48f198
call ebx
add esp, 0x14
push 0x48f198
call fcn.00406870
add esp, 4
jmp 0x417251
mov edx, dword [0x4904ec]
push edx
push 0x4904f0
push 0x444530
push 0x48f198
call ebx
push 0x48f198
call fcn.00406870
add esp, 0x14
call fcn.00415130
test eax, eax
je 0x415f73
push eax
push 0x4445a0
push 0x48f198
call ebx
add esp, 0xc
push 0x48f198
call fcn.00406870
add esp, 4
jmp 0x417251
cmp dword [0x4906fc], 0
ja 0x415f89
cmp dword [0x4906f8], 0
jbe 0x41609a
xor eax, eax
push 0x63e
push eax
lea ecx, [esp + 0x15a2]
push ecx
mov word [esp + 0x15a4], ax
call fcn.00428490
mov eax, 0x490708
add esp, 0xc
mov dword [esp + 0x10], 0x44e414
mov dword [esp + 0x14], eax
cmp dword [eax], 0
jbe 0x41604e
lea edi, [esp + 0x1598]
add edi, 0xfffffffe
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x415fd0
mov edx, dword [0x4445cc]
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [edi], edx
mov edx, eax
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x415ff0
lea edi, [esp + 0x1598]
sub eax, edx
add edi, 0xfffffffe
jmp 0x416010
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x416010
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1598]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x416036
mov ecx, dword [0x4445d0]
mov eax, dword [esp + 0x14]
mov dword [edi], ecx
add dword [esp + 0x10], 4
add eax, 0x18
mov dword [esp + 0x14], eax
cmp eax, 0x4907e0
jl 0x415fba
mov eax, dword [0x490700]
mov ecx, dword [0x4906fc]
lea edx, [esp + 0x1598]
push edx
mov edx, dword [0x4906f8]
push eax
push ecx
push edx
push str.L_eQ_n
push 0x48f198
call ebx
push 0x48f198
call fcn.00406870
add esp, 0x1c
call fcn.00413820
push 0x44463c
mov word [0x48696c], ax
call fcn.00406b20
add esp, 4
cmp dword [0x48ba8c], 0
je 0x416147
mov eax, dword [0x489438]
mov ecx, dword [0x489434]
mov edx, dword [0x489450]
push 0x4881c0
push 0x4881a0
push eax
mov eax, dword [0x48944c]
push ecx
mov ecx, dword [0x489430]
push edx
mov edx, dword [0x48942c]
push eax
mov eax, dword [0x44d62c]
push ecx
mov ecx, dword [0x489428]
push edx
mov edx, dword [0x489424]
push eax
mov eax, dword [0x489420]
push ecx
mov ecx, dword [0x48941c]
push edx
mov edx, dword [0x489418]
push eax
mov eax, dword [0x44d3a4]
push ecx
push edx
push eax
push 0x486954
push 0x487580
push 0x486b78
push str._b_tg_
push 0x48f198
call ebx
push 0x48f198
call fcn.00406870
add esp, 0x54
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0xf8a]
push edx
mov word [esp + 0xf8c], cx
call fcn.00428490
add esp, 0xc
cmp word [0x48696c], 2
jne 0x41618f
cmp dword [0x490780], 0
jbe 0x41618f
mov eax, dword [str.run1.exe]
push eax
push str.C:UsersPublicSMR7_s
lea ecx, [esp + 0xf88]
push ecx
jmp 0x4161a1
push 0x48df60
push str._s_run1.exe
lea edx, [esp + 0xf88]
push edx
call ebx
add esp, 0xc
lea eax, [esp + 0xf80]
push 0
push eax
call fcn.00422560
add esp, 8
test eax, eax
jne 0x4161f4
lea ecx, [esp + 0xf80]
push ecx
push 0x4447c8
push 0x48f198
call ebx
add esp, 0xc
push 0x48f198
call fcn.00406870
add esp, 4
push 0x927c0
lea esi, [esp + 0xf84]
call fcn.0040d870
add esp, 4
mov ecx, 0x43c7d4
call fcn.0040e790
mov ecx, str.wmcUpdater.exe
call fcn.0040e790
call fcn.0040e8d0
push 0x44481c
call fcn.00406b20
add esp, 4
push 0x48cef0
push 0x20000000
push 0
push 0x414d70
push 0
push 0
call fcn.00424559
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
add esp, 0x18
cmp dword [0x48ba7c], esi
jne 0x41625d
cmp esi, 0x258
je 0x41625d
push 0xa
call edi
inc esi
cmp dword [0x48ba7c], 0
je 0x416247
mov ax, word [0x48696c]
cmp ax, 9
jne 0x4162c9
mov edx, dword [0x48ceec]
push 0
push 0x64
push 0x402
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x44482c
call fcn.00406870
mov esi, 0x40010
mov edi, 0x43bdf4
mov ebx, 0x44483c
add esp, 4
push 0x493e0
call fcn.0040d730
add esp, 4
push 0
call fcn.00417270
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1bd0]
xor ecx, esp
call fcn.004217e4
mov esp, ebp
pop ebp
ret 0x10
test ax, ax
je 0x4162e4
push 0x486b78
push 0x44485c
push 0x48f198
call ebx
add esp, 0xc
jmp 0x4162f3
push 0x44487c
push 0x48f198
call ebx
add esp, 8
push 0x48f198
call fcn.00406870
mov eax, dword [0x48ceec]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 4
push 0
push 1
push 0x402
push eax
call esi
push 0x444898
call fcn.00406870
add esp, 4
call fcn.00413ea0
push 0
test eax, eax
jne 0x41635d
mov ecx, dword [0x48ceec]
push 0x64
push 0x402
push ecx
call esi
push 0x4448c8
call fcn.00406870
mov esi, 0x40000
mov edi, str.P_g
mov ebx, str._rN_bT2
jmp 0x416298
mov edx, dword [0x48ceec]
push 0x14
push 0x402
push edx
call esi
push 0x444958
call fcn.00406b20
mov ax, word [0x48696c]
add esp, 4
test ax, ax
jne 0x416389
push 1
jmp 0x4163ab
cmp ax, 1
jne 0x416393
push 3
jmp 0x4163ab
cmp ax, 2
jne 0x41639d
push 3
jmp 0x4163ab
cmp ax, 3
je 0x4163a9
cmp ax, 4
jne 0x4163b3
push 2
call fcn.004153f0
add esp, 4
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x972]
push ecx
mov word [esp + 0x974], ax
call fcn.00428490
add esp, 0xc
cmp word [0x48696c], 2
jne 0x4163fc
cmp dword [0x490798], 0
jbe 0x4163fc
mov edx, dword [str.run2.exe]
push edx
push str.C:UsersPublicSMR7_s
lea eax, [esp + 0x970]
push eax
jmp 0x41640e
push 0x48df60
push str._s_run2.exe
lea ecx, [esp + 0x970]
push ecx
call ebx
add esp, 0xc
lea edx, [esp + 0x968]
push 0
push edx
call fcn.00422560
add esp, 8
test eax, eax
jne 0x416461
lea eax, [esp + 0x968]
push eax
push 0x444984
push 0x48f198
call ebx
add esp, 0xc
push 0x48f198
call fcn.00406870
add esp, 4
push 0x927c0
lea esi, [esp + 0x96c]
call fcn.0040d870
add esp, 4
push 0x44499c
call fcn.00406b20
add esp, 4
cmp word [0x48696c], 2
jne 0x416497
cmp dword [0x4907b0], 0
jbe 0x416497
mov ecx, dword [str.rms.exe]
push ecx
push str.C:UsersPublicSMR7_s
lea edx, [esp + 0x970]
push edx
jmp 0x4164a9
push 0x48df60
push 0x4449ac
lea eax, [esp + 0x970]
push eax
call ebx
add esp, 0xc
lea ecx, [esp + 0x968]
push 0
push ecx
call fcn.00422560
add esp, 8
test eax, eax
jne 0x41651d
lea edx, [esp + 0x968]
push edx
push 0x4449c4
push 0x48f198
call ebx
add esp, 0xc
push 0x48f198
call fcn.00406870
add esp, 4
push 0x1b7740
lea esi, [esp + 0x96c]
call fcn.0040d870
add esp, 4
push 0x4449e8
mov dword [0x4903e0], 1
mov dword [0x48ba78], 0
call fcn.00406870
add esp, 4
push 0x444a14
call fcn.00406b20
add esp, 4
call fcn.004142e0
test eax, eax
jne 0x416572
push eax
mov eax, dword [0x48ceec]
push 0x64
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x444a28
call fcn.00406870
add esp, 4
call fcn.004154f0
push 0xdbba0
mov esi, 0x40040
mov edi, 0x444a6c
mov ebx, str.uP_n0R
jmp 0x4162a0
push 0x444ab8
call fcn.00406b20
add esp, 4
push 0x444ad0
call fcn.00406870
add esp, 4
cmp word [0x48696c], 2
jne 0x416694
mov ecx, dword [0x4906fc]
mov edx, dword [0x4906f8]
push ecx
push edx
push str.C:UsersPublicSMR7WM7ClientPackage.cab
xor ecx, ecx
call fcn.004024f0
add esp, 0xc
push 0x444b98
call fcn.00406b20
add esp, 4
cmp word [0x48696c], 0
je 0x4165da
call fcn.00413070
push 0x3e8
call edi
push 0x444ba4
call fcn.00406b20
add esp, 4
cmp dword [0x489444], 0
jne 0x416644
mov esi, 0x43bd88
jmp 0x416600
mov edx, dword [esi]
mov ecx, str.C:UsersPublicSMR7WM7installTemp_
call fcn.0040e9e0
test eax, eax
jne 0x416639
mov ecx, dword [esi]
push ecx
push 0x444bfc
push 0x48f198
call ebx
add esp, 0xc
push 0x48f198
call fcn.00406870
add esp, 4
mov dword [0x44d6ac], 0
add esi, 4
cmp esi, 0x43bda0
jl 0x416600
cmp word [0x48696c], 0
jne 0x416711
mov eax, 0x486954
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416660
sub eax, edx
sar eax, 1
cmp eax, 9
je 0x416711
push 0x444c18
call fcn.00406870
add esp, 4
mov dword [0x44d6ac], 0
jmp 0x41671a
mov esi, str.C:UsersPublicSMR7WM7ClientPackage.cab
mov eax, 0x486970
call fcn.0040d280
push 0x3e8
call edi
push 0
push esi
call fcn.00422560
add esp, 8
test eax, eax
je 0x4165b7
push 0x486970
push 0x444b00
push 0x48f198
call ebx
add esp, 0xc
push 0x48f198
call fcn.00406870
mov eax, dword [0x48ceec]
add esp, 4
push 0
push 0x64
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.004154f0
push 0xdbba0
mov esi, 0x40010
mov edi, str.pu8
mov ebx, 0x444b40
jmp 0x4162a0
cmp dword [0x44d6ac], 0
jne 0x41675b
mov edx, dword [0x48ceec]
push 0
push 0x64
push 0x402
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x444c40
call fcn.00406870
add esp, 4
call fcn.004154f0
push 0xdbba0
mov esi, 0x40010
mov edi, str.pu8
mov ebx, 0x444c70
jmp 0x4162a0
push 0x444cd4
call fcn.00406870
add esp, 4
push 0x444ce4
call fcn.00406b20
add esp, 4
cmp dword [0x489438], 1
jne 0x4167d0
push 0x444cf8
call fcn.00406870
add esp, 4
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x152]
push ecx
mov word [esp + 0x154], ax
call fcn.00428490
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea edx, [esp + 0x14c]
push str._sWM7F.cab
push edx
call ebx
add esp, 0xc
lea eax, [esp + 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [0x490738], 0
jbe 0x416854
cmp word [0x48696c], 2
jne 0x416854
push 0
push 0x48bea8
call fcn.004224e1
mov edi, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
add esp, 8
test eax, eax
je 0x416807
push 0
push 0x48bea8
push 0
call edi
mov ecx, dword [0x4906fc]
mov edx, dword [0x4906f8]
push ecx
push edx
push 0x48bca0
mov ecx, 2
call fcn.004024f0
add esp, 0xc
push 0x48bca0
push 0x444d40
push 0x48f198
call ebx
add esp, 0xc
push 0x48f198
call fcn.00406870
mov dword [0x48ba80], 1
jmp 0x4168fb
push 0
push 0x48ba98
call fcn.00422560
add esp, 8
test eax, eax
jne 0x4168e1
push eax
push 0x48bea8
call fcn.004224e1
mov edi, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
add esp, 8
test eax, eax
je 0x41688a
push 0
push 0x48bea8
push 0
call edi
mov esi, 0x48bca0
mov eax, 0x48ba98
call fcn.0040d280
mov ax, word [0x48696c]
cmp ax, 1
jne 0x4168b1
push 0x48ba98
push 0x444d64
jmp 0x4168c1
cmp ax, 2
jbe 0x4168cb
push 0x48ba98
push 0x444d8c
push 0x48f198
call ebx
add esp, 0xc
push 0x48f198
call fcn.00406870
mov dword [0x48ba80], 1
jmp 0x4168fb
push 0x444db0
call fcn.00406870
mov edi, dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov dword [0x48ba80], 0
add esp, 4
push 0x444dc4
call fcn.00406b20
add esp, 4
cmp dword [0x490750], 0
jbe 0x416979
cmp word [0x48696c], 2
jne 0x416979
push 0
push 0x48c4c0
call fcn.004224e1
add esp, 8
test eax, eax
je 0x41693c
push 0
push 0x48c4c0
push 0
call edi
mov eax, dword [0x4906fc]
mov ecx, dword [0x4906f8]
push eax
push ecx
push 0x48c2b8
mov ecx, 3
call fcn.004024f0
add esp, 0xc
push 0x48c2b8
push 0x444dd8
push 0x48f198
call ebx
add esp, 0xc
push 0x48f198
jmp 0x416a05
push 0
push 0x48c0b0
call fcn.00422560
add esp, 8
test eax, eax
jne 0x416a00
push eax
push 0x48c4c0
call fcn.004224e1
add esp, 8
test eax, eax
je 0x4169a9
push 0
push 0x48c4c0
push 0
call edi
mov esi, 0x48c2b8
mov eax, 0x48c0b0
call fcn.0040d280
mov ax, word [0x48696c]
cmp ax, 1
jne 0x4169df
push 0x48c0b0
push 0x444dfc
push 0x48f198
call ebx
add esp, 0xc
push 0x48f198
jmp 0x416a05
cmp ax, 2
jbe 0x4169f9
push 0x48c0b0
push 0x444e24
push 0x48f198
call ebx
add esp, 0xc
push 0x48f198
jmp 0x416a05
push 0x444e48
call fcn.00406870
add esp, 4
push 0x444e5c
call fcn.00406b20
add esp, 4
cmp dword [0x490768], 0
jbe 0x416a88
cmp word [0x48696c], 2
jne 0x416a88
push 0
push 0x48cad8
call fcn.004224e1
add esp, 8
test eax, eax
je 0x416a4b
push 0
push 0x48cad8
push 0
call edi
mov edx, dword [0x4906fc]
mov eax, dword [0x4906f8]
push edx
push eax
push 0x48c8d0
mov ecx, 4
call fcn.004024f0
add esp, 0xc
push 0x48c8d0
push 0x444e74
push 0x48f198
call ebx
add esp, 0xc
push 0x48f198
jmp 0x416b14
push 0
push 0x48c6c8
call fcn.00422560
add esp, 8
test eax, eax
jne 0x416b0f
push eax
push 0x48cad8
call fcn.004224e1
add esp, 8
test eax, eax
je 0x416ab8
push 0
push 0x48cad8
push 0
call edi
mov esi, 0x48c8d0
mov eax, 0x48c6c8
call fcn.0040d280
mov ax, word [0x48696c]
cmp ax, 1
jne 0x416aee
push 0x48c6c8
push 0x444ea8
push 0x48f198
call ebx
add esp, 0xc
push 0x48f198
jmp 0x416b14
cmp ax, 2
jbe 0x416b08
push 0x48c6c8
push 0x444ee0
push 0x48f198
call ebx
add esp, 0xc
push 0x48f198
jmp 0x416b14
push 0x444f14
call fcn.00406870
add esp, 4
push 0x444f34
call fcn.00406b20
add esp, 4
push 0x444f58
call fcn.00406870
add esp, 4
call fcn.00414100
push 0x444f8c
call fcn.00406b20
mov ecx, dword [0x48ceec]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
add esp, 4
push 0
push 0x19
push 0x402
push ecx
call edi
mov esi, 1
cmp dword [0x48986c], esi
jne 0x416b91
mov eax, 0x48a870
call fcn.0040f190
push 0x444fc0
call fcn.00406870
add esp, 4
push 0x444fd8
call fcn.00406b20
add esp, 4
call fcn.00414fe0
cmp dword [0x48ba78], esi
jne 0x416c14
push 0x444ff8
call fcn.00406870
add esp, 4
call fcn.0040d200
call fcn.00412d70
test al, al
jne 0x416bfa
mov edx, dword [0x48ceec]
push 0
push 0x64
push 0x402
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x445030
call fcn.00406870
add esp, 4
call fcn.004154f0
push 0xdbba0
mov esi, 0x40010
mov edi, str.P_g
mov ebx, 0x445060
jmp 0x4162a0
push 0x4450bc
call fcn.00406870
add esp, 4
push 0x4450d4
call fcn.00406b20
add esp, 4
mov eax, dword [0x48ceec]
push 0
push 0x32
push 0x402
push eax
call edi
call fcn.0041a500
call fcn.00403b50
test eax, eax
je 0x416c38
call fcn.0041ab60
push 0x4450f4
call fcn.00406b20
add esp, 4
push 0x445104
call fcn.00406870
add esp, 4
call fcn.00417560
push 0x44511c
call fcn.00406b20
mov eax, dword [0x489448]
add esp, 4
test eax, eax
je 0x416ca4
push eax
push 0x445130
push 0x48f198
call ebx
add esp, 0xc
push 0x48f198
call fcn.00406870
mov ecx, dword [0x489448]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Delay_End
call fcn.00406870
add esp, 4
push 0x44517c
call fcn.00406870
add esp, 4
call fcn.00411cc0
mov edx, dword [0x48ceec]
push 0
push 0x4e
push 0x402
push edx
mov esi, eax
call edi
push str.SetupClient
call fcn.00406b20
add esp, 4
call fcn.00405da0
test eax, eax
jne 0x416cfd
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.uP_nw
call fcn.00406870
add esp, 4
call fcn.0040ba00
push 0
push 0
push str.C:UsersPublicSMR7WM7installTemp
call fcn.004084d0
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push str.C:UsersPublicSMR7WM7ClientPackage.cab
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x445208
call fcn.00406870
mov eax, dword [0x48ceec]
add esp, 4
push 0
push 0x50
push 0x402
push eax
call edi
push 0x445218
call fcn.00406b20
add esp, 4
test esi, esi
jne 0x416df3
push 0x445228
call fcn.00406870
add esp, 4
call fcn.0040d200
mov ecx, dword [0x48ceec]
push esi
push 0x5a
push 0x402
push ecx
call edi
call fcn.0041b560
mov edx, dword [0x48ceec]
push esi
push 0x64
push 0x402
push edx
call edi
mov eax, dword [0x48cef0]
push esi
push esi
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
cmp dword [0x44d91c], 1
jne 0x416db0
push 0x44526c
jmp 0x416db5
push 0x4452a0
call fcn.00406870
add esp, 4
call fcn.00419cd0
call fcn.004154f0
push 0xdbba0
mov esi, 0x40010
mov edi, str.P_g
mov ebx, 0x4452e8
call fcn.0040d730
add esp, 4
push 0
call fcn.00417270
add esp, 4
push eax
call fcn.004240bc
mov esi, 1
cmp dword [0x48ba78], esi
jne 0x416e30
push 0x445348
call fcn.00406870
add esp, 4
call fcn.00419950
push 0x445360
call fcn.00406870
add esp, 4
call fcn.0040c500
push 0x44537c
call fcn.00406b20
jmp 0x416e3a
push 0x4453b0
call fcn.00406870
add esp, 4
push esi
call fcn.00418540
mov ecx, dword [0x48ceec]
add esp, 4
push 0
push 0x55
push 0x402
push ecx
call edi
push 0x4453c0
call fcn.00406b20
add esp, 4
push 0x4453d0
call fcn.00406870
add esp, 4
call fcn.00405750
test eax, eax
jne 0x416fbe
cmp dword [0x48ba90], eax
jle 0x416f32
push str.uP_n_U
call fcn.00406870
add esp, 4
lea edi, [esp + 0x14]
mov dword [esp + 0x14], 0
call fcn.0040b8a0
mov edi, dword [esp + 0x14]
mov edx, dword [0x48ba90]
push edi
mov esi, eax
push esi
push edx
push 0x4453f8
push 0x48f198
call ebx
mov eax, dword [0x48ceec]
add esp, 0x14
push 0
push 0x64
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x48cef0]
push 0
push 0
push 0x12
push ecx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0x48f198
call fcn.00406870
mov edx, dword [0x48ba90]
add esp, 4
push edi
push esi
push edx
push 0x445458
push 0x48f198
call ebx
add esp, 0x14
call fcn.004154f0
push 0xdbba0
mov esi, 0x40000
mov edi, 0x445484
mov ebx, 0x48f198
jmp 0x416ddb
push 0x44548c
call fcn.00406870
add esp, 4
call fcn.0040d200
mov eax, dword [0x48ceec]
push 0
push 0x5a
push 0x402
push eax
call edi
call fcn.0041b560
mov ecx, dword [0x48ceec]
push 0
push 0x64
push 0x402
push ecx
call edi
mov edx, dword [0x48cef0]
push 0
push 0
push 0x12
push edx
call dword [sym.imp.USER32.dll_PostThreadMessageW]
cmp dword [0x44d91c], esi
jne 0x416f8e
push 0x44526c
jmp 0x416f93
push 0x4452a0
call fcn.00406870
add esp, 4
call fcn.00419cd0
call fcn.004154f0
push 0xdbba0
mov esi, 0x40010
mov edi, str.P_g
mov ebx, 0x4454b0
jmp 0x416ddb
cmp dword [0x48ba90], 0
jle 0x41700e
push str.uP_n_
call fcn.00406870
add esp, 4
lea edi, [esp + 0x14]
mov dword [esp + 0x14], 0
call fcn.0040b8a0
mov ecx, dword [esp + 0x14]
mov edx, dword [0x48ba90]
push ecx
push eax
push edx
push 0x445508
push 0x48f198
call ebx
add esp, 0x14
push 0x48f198
call fcn.00406870
add esp, 4
mov eax, dword [0x489440]
cmp eax, 1
jne 0x417029
push 0
call fcn.00411710
add esp, 4
push 0x445548
jmp 0x41703d
cmp eax, 2
jne 0x417045
push 1
call fcn.00411710
add esp, 4
push 0x44555c
call fcn.00406b20
add esp, 4
cmp word [0x48696c], 3
jb 0x417061
call fcn.00411870
push 0x445570
call fcn.00406b20
add esp, 4
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1192]
push ecx
mov word [esp + 0x1194], ax
call fcn.00428490
add esp, 0xc
cmp word [0x48696c], 2
jne 0x4170aa
cmp dword [0x4907c8], 0
jbe 0x4170aa
mov edx, dword [str.run3.exe]
push edx
push str.C:UsersPublicSMR7_s
lea eax, [esp + 0x1190]
push eax
jmp 0x4170bc
push 0x48df60
push str._s_run3.exe
lea ecx, [esp + 0x1190]
push ecx
call ebx
add esp, 0xc
lea edx, [esp + 0x1188]
push 0
push edx
call fcn.00422560
add esp, 8
test eax, eax
jne 0x41710f
lea eax, [esp + 0x1188]
push eax
push 0x4455a0
push 0x48f198
call ebx
add esp, 0xc
push 0x48f198
call fcn.00406870
add esp, 4
push 0x927c0
lea esi, [esp + 0x118c]
call fcn.0040d870
add esp, 4
push 0x4455bc
call fcn.00406b20
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
add esp, 4
cmp dword [0x44d3a4], eax
jne 0x417196
cmp dword [0x489418], eax
jne 0x417196
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x152]
push edx
mov word [esp + 0x154], cx
call fcn.00428490
add esp, 0xc
push 0x48ef90
lea eax, [esp + 0x14c]
push str._spcinfo7.exe
push eax
call ebx
add esp, 0xc
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x48ef90
push 0x43d31c
lea ecx, [esp + 0x154]
push ecx
push str.open
push 0
call esi
call fcn.00419cd0
push 0
push 0x43d31c
push 0x4455cc
push str.C:WindowsSysWOW64wmcUpdater.exe
push str.open
push 0
call esi
push 0
push 0x43d31c
push 0x4455cc
push str.C:WindowsSystem32wmcUpdater.exe
push str.open
push 0
call esi
mov edx, dword [0x48ceec]
push 0
push 0x64
push 0x402
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x48cef0]
push 0
push 0
push 0x12
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0x445670
call fcn.00406870
add esp, 4
call fcn.004154f0
push 0xdbba0
mov esi, 0x40000
mov edi, 0x445484
mov ebx, 0x445698
call fcn.0040d730
add esp, 4
push 1
jmp 0x416de5
mov ecx, dword [0x4904ec]
push ecx
push 0x4904f0
push str.__s___u_
push 0x48f198
call ebx
push 0x48f198
call fcn.00406870
add esp, 0x14
mov ecx, dword [esp + 0x1bdc]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004217e4
mov esp, ebp
pop ebp
ret 0x10