Function at 0x4016ed
Capabilities:
Accept command line arguments
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45c527
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x36fc
call fcn.0043fa20
mov eax, dword [0x4809a0]
xor eax, esp
mov dword [esp + 0x36f8], eax
push ebx
push esi
push edi
mov eax, dword [0x4809a0]
xor eax, esp
push eax
lea eax, [esp + 0x3710]
mov dword fs:[0], eax
xor edi, edi
push edi
mov dword [esp + 0x38], ecx
call fcn.0041f864
mov dword [esp], 0x4016dc
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call fcn.0040166d
call fcn.004212ea
test eax, eax
jne 0x40178b
push edi
push edi
push str.Unable_to_initialize_OLE._nTerminating_application_
call fcn.0041e968
xor eax, eax
mov ecx, dword [esp + 0x3710]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x36f8]
xor ecx, esp
call fcn.00438785
mov esp, ebp
pop ebp
ret
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
mov esi, 0x464fb4
push esi
call fcn.00402eb5
call fcn.004146e4
pop ecx
call fcn.004166df
cmp eax, edi
je 0x4017b6
call fcn.00402a33
cmp eax, 1
je 0x401767
call fcn.0041d447
push eax
lea ecx, [esp + 0x30]
call fcn.00403139
and dword [esp + 0x3718], 0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push esi
call fcn.00402eb5
push ecx
mov byte [esp + 0x3720], 1
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x465308
call fcn.00402eb5
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x3724], 0
call fcn.00415bba
add esp, 0xc
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x371c], 2
call fcn.0040317c
mov byte [esp + 0x3718], 0
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.00401109
push 0
lea ecx, [esp + 0x30]
call fcn.0040328d
push eax
call fcn.004068c8
pop ecx
push 2
pop eax
call fcn.00406c3c
lea ecx, [esp + 0x20]
lea edi, [esp + 0x10]
call fcn.0041529d
mov edi, eax
mov byte [esp + 0x3718], 3
call fcn.004151ec
push eax
push dword [edi]
push str.OS_version:__s__Server:_d
call fcn.0040750a
mov byte [esp + 0x3724], 0
mov ecx, dword [esp + 0x1c]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.00401109
lea eax, [esp + 0x10]
push eax
call fcn.00416dc3
pop ecx
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.00401109
call fcn.0041d447
push eax
lea ecx, [esp + 0x34]
call fcn.00403139
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x371c], 4
call fcn.00416dc3
pop ecx
mov byte [esp + 0x3718], 5
push dword [eax]
lea ecx, [esp + 0x18]
call fcn.00402ef9
mov ebx, eax
lea ecx, [esp + 0x20]
lea edi, [esp + 0x10]
mov byte [esp + 0x3718], 6
call fcn.0041529d
mov edi, eax
mov byte [esp + 0x3718], 7
push dword [ebx]
call fcn.004151ec
push eax
push dword [edi]
lea eax, [esp + 0x3c]
push str.meeting.zoho.com
push dword [esp + 0x3c]
push str.Name:JoinEXE_Version:_s_Build:_s_OS:_s_Server:_d_TimeStamp:_s
push eax
call fcn.0040384d
mov ecx, dword [esp + 0x2c]
add esp, 0x1c
add ecx, 0xfffffff0
call fcn.00401109
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.00401109
mov byte [esp + 0x3718], 4
mov ecx, dword [esp + 0x24]
add ecx, 0xfffffff0
call fcn.00401109
push ecx
lea eax, [esp + 0x34]
mov dword [esp + 0x14], esp
mov ecx, esp
push eax
call fcn.0040315e
call fcn.0040a60c
pop ecx
push dword [0x4852b8]
push str.Logging_Started._Path_:_s
call fcn.0040750a
pop ecx
pop ecx
push 0
lea ecx, [esp + 0x30]
call fcn.0040328d
push eax
push 0x484f68
call fcn.004394ed
pop ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.00402eb5
mov edi, 0x485408
mov ecx, edi
call fcn.0041a3ad
push dword [0x4852bc]
push str.App_dir_:_s
call fcn.0040750a
pop ecx
pop ecx
call fcn.0040127c
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0
call fcn.00402eb5
call fcn.00402862
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Settings.conf
call fcn.00402eb5
push edi
call fcn.0041a13b
call fcn.0041a4b8
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push esi
call fcn.00402eb5
call fcn.0041a44f
call fcn.00419eb1
mov eax, dword [0x484070]
mov dword [esp + 0x10], eax
call fcn.00418215
xor ebx, ebx
inc ebx
cmp dword [0x484070], ebx
jle 0x402011
mov eax, dword [0x484078]
mov edi, ebx
shl edi, 2
push dword [edi + eax]
push str._cmdlog
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
jne 0x401a3f
call fcn.00407758
jmp 0x402004
mov eax, dword [0x484078]
push dword [edi + eax]
push str._gateway
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
jne 0x401a82
cmp dword [0x484070], ebx
jl 0x402004
mov eax, dword [0x484078]
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push dword [edi + eax + 4]
call fcn.00402eb5
call fcn.004011af
jmp 0x402004
mov eax, dword [0x484078]
push dword [edi + eax]
push str._gatewayport
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
jne 0x401abf
cmp dword [0x484070], ebx
jl 0x402004
mov eax, dword [0x484078]
push dword [edi + eax + 4]
call fcn.00438ab4
pop ecx
mov dword [0x48542c], eax
jmp 0x402004
mov eax, dword [0x484078]
push dword [edi + eax]
push 0x4654a4
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
jne 0x401ae6
mov dword [0x4853ec], 1
jmp 0x402004
mov eax, dword [0x484078]
push dword [edi + eax]
push str._proxyserver
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
jne 0x401b28
cmp dword [0x484070], ebx
jl 0x401b19
mov eax, dword [0x484078]
push dword [edi + eax + 4]
mov ecx, 0x4853d0
call fcn.00403444
mov dword [0x4853e0], 3
jmp 0x402004
mov eax, dword [0x484078]
push dword [edi + eax]
push str._LanguageId
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
jne 0x401b64
mov eax, dword [0x484078]
push dword [edi + eax + 4]
call fcn.00438ab4
test eax, eax
pop ecx
je 0x401b64
mov esi, eax
call fcn.00402cbf
mov dword [0x485414], eax
mov esi, 0x464fb4
mov eax, dword [0x484078]
push dword [edi + eax]
push str._proxyPac
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
jne 0x401ba6
cmp dword [0x484070], ebx
jl 0x401b97
mov eax, dword [0x484078]
push dword [edi + eax + 4]
mov ecx, 0x4853e4
call fcn.00403444
mov dword [0x4853e0], 1
jmp 0x402004
mov eax, dword [0x484078]
push dword [edi + eax]
push str._proxyport
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
jne 0x401be3
cmp dword [0x484070], ebx
jl 0x402004
mov eax, dword [0x484078]
push dword [edi + eax + 4]
call fcn.00438ab4
pop ecx
mov dword [0x4853d8], eax
jmp 0x402004
mov eax, dword [0x484078]
push dword [edi + eax]
push str._proxyusername
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
jne 0x401c1f
cmp dword [0x484070], ebx
jl 0x402004
mov ecx, 0x4853b0
mov eax, dword [0x484078]
push dword [edi + eax + 4]
call fcn.00403444
jmp 0x402004
mov eax, dword [0x484078]
push dword [edi + eax]
push str._proxypassword
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
jne 0x401c4a
cmp dword [0x484070], ebx
jl 0x402004
mov ecx, 0x4853b4
jmp 0x401c0c
mov eax, dword [0x484078]
push dword [edi + eax]
push str._InstallCustomerPlugin
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
je 0x401ffd
mov eax, dword [0x484078]
push dword [edi + eax]
push str._ICP
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
je 0x401ffd
mov eax, dword [0x484078]
push dword [edi + eax]
push 0x465588
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
je 0x401fec
mov eax, dword [0x484078]
push dword [edi + eax]
push str._viewer
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
je 0x401fec
mov eax, dword [0x484078]
push dword [edi + eax]
push 0x4655a0
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
je 0x401fdb
mov eax, dword [0x484078]
push dword [edi + eax]
push str._agent
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
je 0x401fdb
mov eax, dword [0x484078]
push dword [edi + eax]
push str._CAK
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
jne 0x401d58
cmp dword [0x484070], ebx
jl 0x402004
mov eax, dword [0x484078]
push dword [edi + eax + 4]
lea ecx, [esp + 0x24]
call fcn.00402eb5
lea eax, [esp + 0x20]
push eax
mov ecx, 0x485538
mov byte [esp + 0x371c], 8
call fcn.0040317c
mov byte [esp + 0x3718], 4
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
call fcn.00401109
jmp 0x402004
mov eax, dword [0x484078]
push dword [edi + eax]
push str._UNC
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
jne 0x401d7f
mov dword [0x4852d8], 1
jmp 0x402004
mov eax, dword [0x484078]
push dword [edi + eax]
push str._dir
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
jne 0x401e15
push esi
lea ecx, [esp + 0x20]
call fcn.00402eb5
mov byte [esp + 0x3718], 9
cmp dword [0x484070], ebx
jl 0x401dc3
mov eax, dword [0x484078]
push dword [edi + eax + 4]
lea ecx, [esp + 0x20]
call fcn.00403444
push dword [esp + 0x1c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401de4
push ecx
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], esp
mov ecx, esp
push eax
call fcn.0040315e
jmp 0x401dff
push dword [esp + 0x1c]
push str.Dir_path_is_invalid.
call fcn.004075a0
pop ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push esi
call fcn.00402eb5
call fcn.00402862
mov byte [esp + 0x3718], 4
mov ecx, dword [esp + 0x1c]
jmp 0x401d4b
mov eax, dword [0x484078]
push dword [edi + eax]
push str._UPDATE
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
je 0x40212f
mov eax, dword [0x484078]
push dword [edi + eax]
push str._UpdateDS
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
jne 0x401ec1
call fcn.00414cb8
test eax, eax
je 0x402192
push str.Updating...__UpdateDS
call fcn.004075a0
pop ecx
lea edi, [esp + 0x24]
mov dword [0x4852ac], 1
call fcn.00414a56
push 0
mov ecx, edi
mov byte [esp + 0x371c], 0xb
call fcn.0040328d
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov edi, dword [esp + 0x24]
push edi
push str.Updating...__UpdateDS_:_s
call fcn.004075a0
pop ecx
lea eax, [esp + 0x28]
mov dword [esp + 0x1c], esp
mov ecx, esp
push eax
call fcn.0040315e
call fcn.00402862
mov byte [esp + 0x3718], 4
lea ecx, [edi - 0x10]
jmp 0x401d4e
mov eax, dword [0x484078]
push dword [edi + eax]
push str._UpdateURS
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
jne 0x401f11
call fcn.00414cb8
test eax, eax
je 0x4021a4
push str.Updating...__UpdateDS
call fcn.004075a0
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0
mov dword [0x4852b0], 1
call fcn.00402eb5
call fcn.00402862
jmp 0x402004
mov eax, dword [0x484078]
push dword [edi + eax]
push str._UnInstallURS
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
je 0x4021ba
mov eax, dword [0x484078]
push dword [edi + eax]
push 0x4657b4
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
je 0x40222a
mov eax, dword [0x484078]
push dword [edi + eax]
push str._auth
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
jne 0x401fb7
push esi
lea ecx, [esp + 0x18]
call fcn.00402eb5
mov byte [esp + 0x3718], 0xf
cmp dword [0x484070], ebx
jl 0x401fa3
mov eax, dword [0x484078]
push dword [edi + eax + 4]
lea ecx, [esp + 0x18]
call fcn.00403444
push ecx
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], esp
mov ecx, esp
push eax
call fcn.0040315e
call fcn.0041a3dc
mov byte [esp + 0x3718], 4
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.00401109
mov eax, dword [0x484078]
push dword [edi + eax]
push str._URS
call fcn.0043969a
test eax, eax
pop ecx
pop ecx
jne 0x402004
mov dword [0x48552c], 1
jmp 0x402004
cmp dword [0x484070], ebx
jl 0x402004
mov byte [0x485420], 1
jmp 0x402004
cmp dword [0x484070], ebx
jl 0x402004
mov byte [0x485420], 0
jmp 0x402004
mov byte [0x485427], 1
inc ebx
cmp ebx, dword [0x484070]
jl 0x401a18
call fcn.00402e6d
test al, al
jne 0x402025
push str.ZohoTray_:_Problem_with_setting_Resource_Olnly_DLL
call fcn.0040750a
pop ecx
call fcn.00414c6b
test eax, eax
mov dword [0x484f60], eax
mov edi, str.join.exe
jne 0x4020a3
mov ebx, dword [0x485414]
lea eax, [esp + 0x20]
push 0x234a
push eax
call fcn.00416b80
pop ecx
pop ecx
push 0
mov byte [esp + 0x371c], 0x10
mov eax, dword [eax]
push 4
push eax
call fcn.0041e968
mov byte [esp + 0x3718], 4
mov ecx, dword [esp + 0x20]
add ecx, 0xfffffff0
mov ebx, eax
call fcn.00401109
cmp ebx, 6
jne 0x4022f8
push str.Some_other_instance_running._Terminating_them_and_starting_our_process
call fcn.0040750a
pop ecx
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edi
call fcn.00402eb5
call fcn.00414e7a
pop ecx
pop ecx
lea eax, [esp + 0x534]
push eax
call fcn.004080d0
mov byte [esp + 0x3718], 0x11
call fcn.00409e04
lea eax, [esp + 0x28]
push eax
call fcn.00414e19
pop ecx
mov byte [esp + 0x3718], 0x12
push dword [esp + 0x10]
push dword [esp + 0x2c]
push str.CommandLineArgs_:__s_arglen:_d
call fcn.0040750a
pop ecx
pop ecx
lea eax, [esp + 0x2c]
mov dword [esp + 0x1c], esp
mov ecx, esp
push eax
call fcn.0040315e
push dword [esp + 0x14]
call fcn.00402b17
xor ebx, ebx
inc ebx
cmp eax, ebx
jne 0x402307
push str.Exe_launched
call fcn.0040750a
pop ecx
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.00401109
lea esi, [esp + 0x534]
call fcn.004081d9
mov esi, ebx
jmp 0x402173
lea edi, [esp + 0x14]
call fcn.00414a56
push 0
mov ecx, edi
mov byte [esp + 0x371c], 0xa
call fcn.0040328d
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push ecx
mov eax, edi
mov dword [esp + 0x1c], esp
mov ecx, esp
push eax
call fcn.0040315e
call fcn.00402862
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.00401109
xor esi, esi
inc esi
mov ecx, dword [esp + 0x30]
add ecx, 0xfffffff0
call fcn.00401109
mov ecx, dword [esp + 0x2c]
add ecx, 0xfffffff0
call fcn.00401109
mov eax, esi
jmp 0x401767
push 0
push 0
push str.Automatic_update_has_failed_
call fcn.0041e968
xor esi, esi
jmp 0x402173
call fcn.00402a33
mov esi, eax
push esi
push str.Applcation_restarted_as_UAC_elevated_process:_d
call fcn.004075a0
pop ecx
pop ecx
jmp 0x4021a0
call fcn.00414cb8
test eax, eax
je 0x4021a4
push str.uninstalling_urs
call fcn.004075a0
pop ecx
lea eax, [esp + 0x10]
push eax
call fcn.0041b1a6
mov byte [esp + 0x3718], 0xc
call fcn.0041b72c
push str.Uninstalling_service_and_quitting_tray
call fcn.004075a0
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Zoho_Assist_Unattended_Support
call fcn.00402eb5
push 0x85
call fcn.0041592b
pop ecx
pop ecx
push 0
push 0
push str.The_Unattended_Agent_is_now_removed.
call fcn.0041e968
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.00401109
jmp 0x4021a0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
lea ecx, [esp + 0x20]
call fcn.00402eb5
mov byte [esp + 0x3718], 0xd
cmp dword [0x484070], ebx
jl 0x402261
mov eax, dword [0x484078]
push dword [eax + ebx*4 + 4]
lea ecx, [esp + 0x20]
call fcn.00403444
push dword [esp + 0x1c]
and dword [esp + 0x24], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4022df
push 0x104
lea eax, [esp + 0x3500]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x20]
push eax
push ecx
lea eax, [esp + 0x3504]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00402eb5
push ecx
lea eax, [esp + 0x28]
mov dword [esp + 0x40], esp
mov ecx, esp
push eax
mov byte [esp + 0x3728], 0xe
call fcn.0040315e
mov byte [esp + 0x3724], 0xd
call fcn.004149b5
add esp, 0xc
push eax
push dword [esp + 0x24]
push str.Exe_updated:er:_d_:_res___d
call fcn.004075a0
add esp, 0xc
jmp 0x4022ef
push dword [esp + 0x1c]
push str.invalid_path_file:_s
call fcn.004075a0
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c]
jmp 0x402168
push str.Another_instance_running._User_chose_to_quit_application
call fcn.0040750a
jmp 0x4021b7
cmp dword [0x4853ec], ebx
jne 0x402473
call fcn.0041d447
push eax
lea ecx, [esp + 0x20]
call fcn.00403139
lea eax, [esp + 0x10]
push eax
mov byte [esp + 0x371c], 0x13
call fcn.00401193
mov byte [esp + 0x3718], 0x14
movzx ecx, byte [0x485420]
push ecx
push dword [eax]
lea eax, [esp + 0x24]
push str.Join_Start_k_s_Role_d_UpdateTypeSilent
push eax
call fcn.0040384d
mov byte [esp + 0x3728], 0x13
mov ecx, dword [esp + 0x20]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00401109
push ecx
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], esp
mov ecx, esp
push eax
call fcn.0040315e
lea ecx, [esp + 0x538]
call fcn.004094a9
cmp eax, 7
je 0x4023c9
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.meeting.zoho.com
call fcn.00402eb5
lea eax, [esp + 0x538]
push eax
call fcn.0040abd8
push ecx
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], esp
mov ecx, esp
push eax
call fcn.0040315e
lea ecx, [esp + 0x538]
call fcn.004094a9
call fcn.0041d447
push eax
lea ecx, [esp + 0x18]
call fcn.00403139
push ecx
mov byte [esp + 0x371c], 0x15
mov eax, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00401193
mov edi, 0x485290
push edi
call fcn.00404d2c
test eax, eax
je 0x402418
lea eax, [esp + 0x14]
push eax
xor ecx, ecx
call fcn.0040570b
push dword [esp + 0x14]
push str.Silent_Update_:__s
call fcn.0040750a
pop ecx
pop ecx
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.UpTypeSilent
call fcn.00402eb5
mov byte [esp + 0x3720], 0x16
movzx eax, byte [0x485420]
push eax
push ecx
mov eax, esp
mov dword [esp + 0x44], esp
push eax
call fcn.00401193
mov ecx, edi
mov byte [esp + 0x3728], 0x15
call fcn.00404305
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.00401109
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.00401109
jmp 0x402113
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x44]
call fcn.00402eb5
push esi
lea ecx, [esp + 0x40]
mov byte [esp + 0x371c], 0x17
call fcn.00402eb5
mov byte [esp + 0x3718], 0x18
call fcn.0041d447
push eax
lea ecx, [esp + 0x24]
call fcn.00403139
mov byte [esp + 0x3718], 0x19
cmp dword [0x4857c4], 0
je 0x4025a7
push str.Preparing_for_first_time_installation
call fcn.004075a0
pop ecx
call fcn.0041d447
push eax
lea ecx, [esp + 0x18]
call fcn.00403139
lea esi, [esp + 0x10]
mov byte [esp + 0x3718], 0x1a
call fcn.004148ca
push edi
mov byte [esp + 0x371c], 0x1b
push dword [eax]
lea eax, [esp + 0x1c]
push 0x4651c4
push eax
call fcn.0040384d
mov byte [esp + 0x3728], 0x1a
mov ecx, dword [esp + 0x20]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00401109
push 0x104
lea eax, [esp + 0x3500]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
or dword [esp + 0x10], 0xffffffff
lea eax, [esp + 0x10]
push eax
push ecx
lea eax, [esp + 0x3504]
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
call fcn.00402eb5
push ecx
mov byte [esp + 0x3724], 0x1c
lea eax, [esp + 0x20]
mov dword [esp + 0x30], esp
mov ecx, esp
push eax
call fcn.0040315e
mov byte [esp + 0x3724], 0x1a
call fcn.004149b5
add esp, 0xc
push dword [esp + 0x10]
push str.Join_exe_copied_Exe_copied:_d
call fcn.004075a0
pop ecx
pop ecx
call fcn.004013be
mov byte [esp + 0x3718], 0x19
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.00401109
mov esi, 0x464fb4
mov edi, dword [esp + 0x20]
cmp dword [edi - 0xc], 5
jle 0x4025c7
push ecx
lea eax, [esp + 0x24]
mov dword [esp + 0x1c], esp
mov ecx, esp
push eax
call fcn.0040315e
call fcn.0041a44f
push esi
lea ecx, [esp + 0x3c]
call fcn.00402eb5
push str.After_GetConnection
mov byte [esp + 0x371c], 0x1d
call fcn.0040750a
pop ecx
lea ebx, [esp + 0x44]
call fcn.0040c1c1
mov ecx, dword [esp + 0x34]
mov eax, ebx
mov byte [esp + 0x3718], 0x1e
mov dword [ecx + 0x20], eax
mov ecx, ebx
call fcn.00420e07
push str.Done
call fcn.004075a0
pop ecx
mov eax, ebx
push eax
mov byte [esp + 0x371c], 0x1d
call fcn.0040c32d
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.00401109
lea ecx, [edi - 0x10]
call fcn.00401109
mov ecx, dword [esp + 0x3c]
add ecx, 0xfffffff0
call fcn.00401109
mov ecx, dword [esp + 0x40]
add ecx, 0xfffffff0
call fcn.00401109
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.00401109
lea esi, [esp + 0x534]
call fcn.004081d9
jmp 0x4021a0