Function at 0x4079bd
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Copy file
Create process on windows
Delete file
Read .ini file
Terminate process

Disassembly:
mov eax, 0x41a755
call fcn.00410e40
sub esp, 0xf50
mov eax, dword [0x4240b8]
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
push 0x400
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push esi
push esi
push esi
lea eax, [ebp - 0xf38]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jae 0x407a40
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
cmp eax, 0x404
push esi
push esi
je 0x407a2f
cmp eax, 0x804
je 0x407a28
push str.You_need_Windows_2000_XP_or_higher_version_to_run_Lava_Lava.
jmp 0x407a34
push 0x41f5e0
jmp 0x407a34
push 0x41f580
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4086c6
push str.Riched20.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov eax, dword [ebp + 8]
mov dword [0x4258f0], eax
call fcn.004099fd
mov ebx, dword [ebp + 0x10]
push ebx
push str._n_n_t_tLlsetup_Version2007_10_8_nlpCmdLine_s_n
call fcn.00409a2f
push 0x6f
lea ecx, [ebp - 0xf14]
call fcn.0040705d
add esp, 0xc
test eax, eax
je 0x407a90
push dword [ebp - 0xf14]
call fcn.0040a08a
test eax, eax
jge 0x407a97
push 0xfffffffffffffffe
call fcn.0040f475
push 0
call fcn.0040a44b
push 0x6d
lea ecx, [ebp - 0xf14]
call fcn.0040705d
test eax, eax
pop ecx
je 0x407b4c
mov edi, dword [ebp - 0xf14]
lea eax, [edi + 4]
mov cx, word [eax]
cmp cx, 0x66
je 0x407ad3
cmp cx, 0x46
je 0x407ad3
push eax
call fcn.0040f24a
pop ecx
mov dword [0x425f10], eax
jmp 0x407ada
or dword [0x425f10], 0xffffffff
mov word [edi + 2], 0x20
cmp dword [0x425f10], 1
jne 0x407b4c
push 0x61
xor ecx, ecx
call fcn.0040705d
test eax, eax
pop ecx
je 0x407b4c
push 0x104
lea eax, [ebp - 0x420]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push 0x5c
push eax
call fcn.0040f24f
pop ecx
pop ecx
push dword [0x424de4]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x420]
push eax
push 0x41da78
push dword [0x424dec]
push dword [0x424de8]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x407b4e
xor edi, edi
cmp dword [0x425f10], edi
jne 0x407b94
push edi
push edi
push edi
push str.DownloadNow
push str.FullVersion
call fcn.0040793e
xor ecx, ecx
inc ecx
add esp, 0x14
cmp eax, ecx
jne 0x407b7a
mov dword [0x425f10], ecx
jmp 0x407b94
push edi
push edi
push edi
push str.Type
push 0x41f454
call fcn.0040793e
add esp, 0x14
mov dword [0x425f10], eax
push 0x66
lea ecx, [ebp - 0xf14]
call fcn.0040705d
test eax, eax
pop ecx
je 0x407c8d
mov eax, dword [ebp - 0xf14]
add eax, 4
push eax
call fcn.0040f24a
cmp eax, 1
pop ecx
jne 0x407be1
xor ecx, ecx
call fcn.0040728e
test eax, eax
lea eax, [ebp - 0x420]
je 0x407bda
push 0x41f450
jmp 0x407c60
push 0x41fafc
jmp 0x407c60
cmp eax, 2
jne 0x407c55
push 0
xor ecx, ecx
lea ebx, [ebp + 0x10]
call fcn.0040712d
pop ecx
mov dword [ebp - 4], 3
mov esi, dword [ebp + 0x10]
xor edi, edi
cmp dword [esi - 0xc], edi
jne 0x407c19
lea eax, [ebp - 0x420]
push 0x41f44c
push eax
call fcn.0040dba0
pop ecx
pop ecx
jmp 0x407c47
push 0x4259c0
lea eax, [ebp + 0x10]
push eax
call fcn.004047d6
mov esi, dword [ebp + 0x10]
push edi
push edi
push 0x208
lea eax, [ebp - 0x420]
push eax
push 0xffffffffffffffff
push esi
push edi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
or dword [ebp - 4], 0xffffffff
lea eax, [esi - 0x10]
call fcn.0040252d
jmp 0x407c68
push 0x41f44c
lea eax, [ebp - 0x420]
push eax
call fcn.0040dba0
pop ecx
pop ecx
lea eax, [ebp - 0x420]
push eax
call fcn.0040f82e
lea eax, [ebp - 0x420]
push eax
push str._f_return_S_n
call fcn.00409a2f
add esp, 0xc
jmp 0x4086c6
call fcn.0040b486
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.LVLV_221.EXE
call esi
mov ebx, dword [ebp + 0x10]
push 0x72
xor ecx, ecx
call fcn.0040705d
test eax, eax
pop ecx
je 0x407cbf
push ebx
call fcn.00407401
xor eax, eax
pop ecx
inc eax
jmp 0x4087ce
push dword [0x424ccc]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x425a88
lea eax, [ebp - 0x218]
push eax
call edi
cmp dword [0x425f10], 0
je 0x407d22
push 0x41f428
lea eax, [ebp - 0x218]
push eax
call edi
push 0xa
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x218]
push eax
push dword [0x425f10]
call fcn.0040f4ba
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x407d52
test ebx, ebx
je 0x407d52
mov dword [ebp - 0xf18], 1
jmp 0x407d59
and dword [ebp - 0xf18], 0
push dword [ebp - 0xf18]
push str.bExistMutex_d_n
call fcn.00409a2f
cmp dword [ebp - 0xf18], 0
pop ecx
pop ecx
je 0x407dcc
call fcn.00407677
test al, al
jne 0x407dcc
mov ebx, dword [ebp + 0x10]
push 0x69
xor ecx, ecx
call fcn.0040705d
test eax, eax
pop ecx
jne 0x407dcc
test ebx, ebx
je 0x407dc1
cmp word [ebx], ax
je 0x407dc1
push 0x71
xor ecx, ecx
call fcn.0040705d
test eax, eax
pop ecx
jne 0x407db7
push 0x72
xor ecx, ecx
call fcn.0040705d
test eax, eax
pop ecx
je 0x4086c6
call fcn.0040b4a4
jmp 0x4086c6
push ebx
call fcn.004089d9
jmp 0x4086c6
mov ebx, dword [ebp + 0x10]
push 0x71
xor ecx, ecx
call fcn.0040705d
test eax, eax
pop ecx
je 0x407e11
xor esi, esi
lea eax, [ebp + 0x10]
push esi
push eax
call fcn.00404c9f
mov eax, dword [ebp + 0x10]
cmp dword [eax - 0xc], esi
pop ecx
pop ecx
je 0x407dff
push esi
call fcn.0040ba7d
cmp eax, 2
je 0x407dff
inc esi
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
call fcn.0040252d
mov eax, esi
jmp 0x4087ce
mov ebx, dword [ebp + 0x10]
push 0x67
xor ecx, ecx
call fcn.0040705d
test eax, eax
pop ecx
je 0x407ea9
push 0x20
push ebx
call fcn.0040f1c9
pop ecx
pop ecx
mov esi, eax
jmp 0x407e36
inc esi
inc esi
cmp word [esi], 0x20
je 0x407e34
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0xf5c]
mov ecx, esi
call fcn.00403372
mov ebx, eax
push esi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str..CRC
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push 0x41f3f4
push eax
call fcn.0040f92b
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x4086c6
push dword [ebp - 0xf48]
push ebx
push esi
push str._s_u_u60000000
push edi
call fcn.0040f93e
push edi
call fcn.0040f9e8
add esp, 0x18
jmp 0x4086c6
mov ebx, dword [ebp + 0x10]
push 0x6a
xor ecx, ecx
call fcn.0040705d
test eax, eax
pop ecx
je 0x407ece
push 0
push dword [ebp + 8]
push 2
pop ecx
call fcn.0040d008
pop ecx
pop ecx
jmp 0x4087ce
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
push str._______Self_Program_s_n
call fcn.00409a2f
pop ecx
pop ecx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xd08]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str..DEL
lea eax, [ebp - 0xd08]
push eax
call edi
lea eax, [ebp - 0xd08]
push eax
call esi
call fcn.0040c74b
mov ebx, dword [ebp + 0x10]
push 0x69
xor ecx, ecx
call fcn.0040705d
xor ebx, ebx
test eax, eax
pop ecx
je 0x4080c9
push ebx
push ebx
push ebx
push str.ForbidInstallIfFullVerExist
mov esi, 0x41f454
push esi
call fcn.0040793e
add esp, 0x14
cmp eax, 1
jne 0x407fd5
mov edi, 0x104
push edi
lea eax, [ebp - 0x8f8]
push eax
push ebx
call fcn.0040a9f4
test eax, eax
je 0x407fd5
lea eax, [ebp - 0x8f8]
push eax
call fcn.0040a96e
test eax, eax
pop ecx
je 0x407fd5
push edi
lea eax, [ebp - 0xb00]
push eax
push 1
push str.MsgTextForbidInstall
push esi
call fcn.0040793e
push edi
lea eax, [ebp - 0x420]
push eax
push 1
push str.MsgTtitleForbidInstall
push esi
call fcn.0040793e
add esp, 0x28
push 0x10
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xb00]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push 5
push str.uninst.exe__u
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x4086c6
lea eax, [ebp - 0x218]
push eax
push str.CheckAndRun_SetRegister_:_s_n
call fcn.00409a2f
pop ecx
pop ecx
call fcn.0040c8ff
lea eax, [ebp - 0x218]
push 0x5c
push eax
call fcn.0040f24f
cmp eax, ebx
pop ecx
pop ecx
je 0x408005
mov word [eax + 2], bx
lea esi, [ebp - 0x218]
call fcn.0040ae52
lea eax, [ebp - 0xf14]
push 1
push eax
call fcn.00404c9f
pop ecx
pop ecx
mov dword [ebp - 4], 4
push dword [0x424cec]
lea eax, [ebp - 0xf14]
push eax
call fcn.004047d6
push dword [ebp - 0xf14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0xf1c]
push ebx
push eax
call fcn.00404c9f
pop ecx
pop ecx
lea edi, [ebp - 0xf14]
mov byte [ebp - 4], 5
call fcn.004046b6
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xf1c]
add eax, 0xfffffff0
call fcn.0040252d
push dword [0x424cec]
mov eax, edi
push eax
call fcn.004047d6
push dword [ebp - 0xf14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push dword [0x424cd4]
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp dword [ebp - 0xf18], ebx
je 0x4080b7
mov eax, dword [ebp - 0xf14]
add eax, 0xfffffff0
call fcn.0040252d
jmp 0x4086c6
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xf14]
add eax, 0xfffffff0
call fcn.0040252d
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x4080e3
cmp word [edi], bx
je 0x4080e3
push 0x73
xor ecx, ecx
mov ebx, edi
call fcn.0040705d
pop ecx
xor ebx, ebx
push 1
mov esi, 0x425f18
push esi
call fcn.004041b6
movzx eax, al
push eax
push str.nExistInstall_d_n
mov dword [ebp - 0xf14], eax
call fcn.00409a2f
cmp dword [ebp - 0xf14], ebx
pop ecx
pop ecx
jne 0x40811e
push ebx
push esi
call fcn.004041b6
movzx eax, al
mov dword [ebp - 0xf14], eax
push dword [ebp - 0xf14]
push str.nExistLocalUpdateFile_d_n
call fcn.00409a2f
mov eax, dword [0x425f10]
xor esi, esi
inc esi
cmp dword [ebp - 0xf14], esi
pop ecx
pop ecx
jne 0x4081f2
cmp eax, 0xffffffff
je 0x4084bc
cmp eax, esi
je 0x40851b
call fcn.004073d9
call fcn.0040abaf
test eax, eax
jg 0x408192
push 0x63
xor ecx, ecx
mov ebx, edi
call fcn.0040705d
test eax, eax
pop ecx
jne 0x408190
call fcn.00407677
test al, al
jne 0x408190
push 0x61
xor ecx, ecx
call fcn.0040705d
test eax, eax
pop ecx
jne 0x4086c6
jmp 0x40820b
xor ebx, ebx
call fcn.004076df
push 0x104
lea esi, [ebp - 0xb00]
call fcn.0040ab5f
test eax, eax
je 0x40852c
mov eax, esi
push eax
push dword [ebp + 8]
push 3
pop ecx
call fcn.0040d008
test eax, eax
pop ecx
pop ecx
jg 0x4086c6
mov ebx, dword [ebp + 0x10]
push 0x63
xor ecx, ecx
call fcn.0040705d
test eax, eax
pop ecx
jne 0x4086c6
push 0x61
xor ecx, ecx
call fcn.0040705d
test eax, eax
pop ecx
jne 0x4086c6
mov edi, ebx
jmp 0x40820b
cmp eax, ebx
jle 0x408200
push 2
pop ebx
call fcn.00407849
jmp 0x40820b
cmp eax, 0xffffffff
jne 0x40820b
mov dword [0x425f10], esi
push 0x63
xor ecx, ecx
mov ebx, edi
call fcn.0040705d
test eax, eax
pop ecx
jne 0x4083f8
push 0x61
xor ecx, ecx
call fcn.0040705d
test eax, eax
pop ecx
jne 0x4083f8
push 0x71
xor ecx, ecx
call fcn.0040705d
test eax, eax
pop ecx
jne 0x4083f8
push 0x73
xor ecx, ecx
call fcn.0040705d
xor esi, esi
test eax, eax
pop ecx
jne 0x40825c
cmp word [edi], si
jne 0x40830d
push esi
call fcn.0040c073
test eax, eax
jne 0x40830d
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x8f8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x8f8]
push 0x5c
push eax
call fcn.0040f24f
cmp eax, esi
pop ecx
pop ecx
je 0x40830d
push str._appdataconfAutoLogin.ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x8f8]
push eax
push ebx
lea eax, [ebp - 0x420]
push eax
push esi
push str.AUTO_LOGIN_GIDs
push str.GENERAL
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x420]
push eax
push str.AutoLogin.ini_s_n
call fcn.00409a2f
cmp word [ebp - 0x420], si
pop ecx
pop ecx
je 0x40830d
lea eax, [ebp - 0x420]
cmp word [eax], 0x2c
jne 0x4082eb
mov word [eax], 0x20
inc eax
inc eax
cmp word [eax], si
jne 0x4082e0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x41f174
push edi
call esi
lea eax, [ebp - 0x420]
push eax
lea eax, [edi + 6]
push eax
call esi
push 0x4c
xor ecx, ecx
mov ebx, edi
call fcn.0040705d
test eax, eax
pop ecx
je 0x4083b7
mov esi, 0x41f16c
lea edi, [ebp - 0x4e8]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x30
pop ecx
xor eax, eax
lea edi, [ebp - 0x4e2]
rep stosd dword es:[edi], eax
push 0x20
push dword [ebp + 0x10]
stosw word es:[edi], ax
call fcn.0040f1c9
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4083d9
jmp 0x408358
inc esi
inc esi
cmp word [esi], 0x20
je 0x408356
push 0x20
push esi
call fcn.0040f1c9
mov edi, eax
mov ax, word [esi]
cmp ax, 0x2f
pop ecx
pop ecx
je 0x4083af
cmp ax, 0x2d
je 0x4083af
test edi, edi
jne 0x40838d
push esi
lea eax, [ebp - 0x4e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x4083a3
mov eax, edi
sub eax, esi
sar eax, 1
inc eax
push eax
push esi
lea eax, [ebp - 0x4e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 0x4e8]
push eax
call fcn.004089d9
test edi, edi
mov esi, edi
jne 0x408358
jmp 0x4083d9
push edi
call fcn.004089d9
test eax, eax
je 0x40853f
push 0x64
xor ecx, ecx
mov ebx, edi
call fcn.0040705d
test eax, eax
pop ecx
jne 0x40853f
call fcn.0040abaf
push eax
push str.GetLastCheckDiff_d_n
call fcn.00409a2f
pop ecx
pop ecx
call fcn.0040abaf
test eax, eax
jle 0x4086c6
cmp dword [ebp - 0xf14], 1
je 0x4086c6
mov ebx, dword [ebp + 0x10]
push 0x63
xor ecx, ecx
call fcn.0040705d
test eax, eax
pop ecx
je 0x408428
push 0x14
pop eax
cmp dword [0x424c70], eax
jle 0x408428
mov dword [0x424c70], eax
jmp 0x40842d
call fcn.004073d9
push 0
mov esi, 0x425f18
push esi
call fcn.00404e03
test eax, eax
jge 0x408481
push 0x63
xor ecx, ecx
call fcn.0040705d
test eax, eax
pop ecx
je 0x408457
push 0
push 0x6a
push 0
call fcn.00409e33
push str.Network_is_disconnect._n
call fcn.00409a2f
pop ecx
push 0
push 0x425f18
call fcn.004041b6
movzx eax, al
test eax, eax
mov dword [ebp - 0xf14], eax
je 0x4086c6
jmp 0x4084b2
je 0x408574
push eax
push str.nUpdateFiles_d_n
call fcn.00409a2f
pop ecx
pop ecx
push 0
mov edi, 0x425f18
push edi
call fcn.004041b6
movzx eax, al
test eax, eax
mov dword [ebp - 0xf14], eax
je 0x40859e
mov edi, dword [ebp + 0x10]
xor ebx, ebx
jmp 0x40811e
mov eax, dword [0x425f1c]
mov eax, dword [eax]
push dword [eax + 0x38]
push str.g_nMiniType___1_g_FileList_s_n
call fcn.00409a2f
pop ecx
pop ecx
push str.llsetup.ini
push ebx
push str.AskUser
push str.FullVersion
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, esi
push ebx
jne 0x408501
mov eax, dword [0x425f1c]
mov eax, dword [eax]
mov ebx, dword [eax + 0x38]
call fcn.0040bef3
jmp 0x4086c6
call fcn.0040ba7d
cmp eax, esi
jne 0x4086c6
push 4
pop ebx
call fcn.00407849
jmp 0x4086c6
mov ebx, esi
call fcn.00407849
push 0x41da74
jmp 0x407dc2
push ebx
push dword [ebp + 8]
push 2
pop ecx
call fcn.0040d008
pop ecx
pop ecx
jmp 0x4086c6
cmp dword [ebp - 0xf18], 0
jne 0x4086c6
push 0x104
lea esi, [ebp - 0xf10]
call fcn.0040ab5f
test eax, eax
je 0x40856a
call fcn.004076df
mov eax, esi
push eax
jmp 0x40856c
push 0
push dword [ebp + 8]
xor ecx, ecx
inc ecx
jmp 0x408533
push 0x63
xor ecx, ecx
call fcn.0040705d
test eax, eax
pop ecx
je 0x40858d
push 0
push 0x74
push 0
call fcn.00409e33
call fcn.004073d9
push str.Need_not_update._n
call fcn.00409a2f
jmp 0x408539
mov eax, dword [ebp + 8]
call fcn.00408d02
sub esp, 0x21c
mov eax, esi
mov ebx, esp
mov dword [ebp - 0xf1c], esp
call fcn.004087e7
mov ebx, dword [ebp + 8]
call fcn.00408ae4
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
add esp, 0x21c
xor ebx, ebx
jmp 0x4085ed
lea eax, [ebp - 0xf38]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xf38]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
lea eax, [ebp - 0xf38]
push ebx
push eax
call esi
test eax, eax
jne 0x4085d3
push edi
call fcn.004039f8
cmp eax, 0x64
jne 0x4086c6
push ebx
mov ecx, edi
call fcn.00404055
cmp dword [0x425f10], 1
jne 0x408624
push 9
jmp 0x408510
push 0x104
lea eax, [ebp - 0x6f0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x6f0]
push 0x5c
push eax
call fcn.0040f24f
mov esi, eax
movzx eax, byte [0x425f28]
push eax
inc esi
push str.g_FileList.m_bExitLava_is__d_._n
inc esi
call fcn.00409a2f
add esp, 0x10
cmp byte [0x425f28], bl
jne 0x4086cd
mov word [esi], bx
xor esi, esi
mov eax, dword [0x425f1c]
cmp eax, ebx
je 0x4086bd
mov ecx, dword [0x425f20]
sub ecx, eax
sar ecx, 2
cmp esi, ecx
jae 0x4086bd
lea eax, [eax + esi*4]
mov eax, dword [eax]
lea ecx, [ebp - 0x6f0]
push ecx
push dword [eax + 0x38]
push str.ExecuteUpdate__RunSfxSetup__s_at__s._n
call fcn.00409a2f
mov eax, dword [0x425f1c]
lea eax, [eax + esi*4]
mov eax, dword [eax]
mov ebx, dword [eax + 0x38]
add esp, 0xc
lea ecx, [ebp - 0x6f0]
push ecx
call fcn.0040bef3
inc esi
xor ebx, ebx
jmp 0x40866b
push 1
mov ecx, edi
call fcn.00404055
xor eax, eax
jmp 0x4087ce
xor edi, edi
push dword [edi + 0x424cf8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x6f0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add edi, 4
cmp edi, 0xc
jb 0x4086cf
mov word [esi], bx
mov eax, dword [0x425f1c]
cmp eax, ebx
jne 0x408701
xor edi, edi
jmp 0x40870c
mov edi, dword [0x425f20]
sub edi, eax
sar edi, 2
xor esi, esi
cmp edi, ebx
jle 0x4087b3
jmp 0x40871d
mov eax, dword [0x425f1c]
lea eax, [eax + esi*4]
mov eax, dword [eax]
lea ecx, [ebp - 0x6f0]
push ecx
push dword [eax + 0x38]
push str.Find_whatsnew.exe__RunSfxSetup__s_at__s._n
call fcn.00409a2f
mov eax, dword [0x425f1c]
lea eax, [eax + esi*4]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
push str.whatsnew
push eax
call fcn.0040f5a2
add esp, 0x14
test eax, eax
je 0x4087aa
lea eax, [ebp - 0x6f0]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.whatsnewtmp.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [0x425f1c]
push ebx
lea eax, [eax + esi*4]
mov eax, dword [eax]
lea ecx, [ebp - 0x218]
push ecx
push dword [eax + 0x38]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x6f0]
push eax
lea ebx, [ebp - 0x218]
call fcn.0040bef3
xor ebx, ebx
inc esi
cmp esi, edi
jl 0x408718
push 0x41ef68
call fcn.00409a2f
pop ecx
call fcn.004073d9
call fcn.004076df
mov eax, dword [ebp - 0xf30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00410647
pop edi
pop esi
pop ebx
leave
ret 0x10