Function at 0x4088e6
Capabilities:
Create thread
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x374
mov eax, dword [0x474194]
xor eax, esp
mov dword [esp + 0x370], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [0x477624], eax
mov dword [0x476158], 0x46bf1c
call fcn.00408426
push eax
call fcn.00405c7e
mov al, byte [0x46c12a]
mov byte [esp + 0x17c], al
mov dword [esp], 0x1ff
xor ebx, ebx
lea eax, [esp + 0x17d]
push ebx
push eax
call fcn.00456240
lea eax, [esp + 0x184]
add esp, 0xc
push eax
call fcn.00401939
pop ecx
lea eax, [esp + 0x178]
push eax
call fcn.00401892
pop ecx
push eax
push edx
push str._X_X
mov esi, 0x477788
push esi
call fcn.00450312
add esp, 0x10
lea eax, [esp + 0x14]
push eax
push 0xf003f
push ebx
push str.SOFTWARE
push 0x80000002
mov dword [0x47615c], esi
mov byte [esp + 0x24], bl
mov byte [esp + 0x23], bl
mov byte [esp + 0x26], bl
mov byte [esp + 0x27], bl
mov byte [esp + 0x25], bl
mov byte [esp + 0x22], bl
mov byte [esp + 0x43], bl
mov byte [esp + 0x30], bl
mov byte [esp + 0x42], bl
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [esp + 0x14], ebx
setne byte [esp + 0x1a]
cmp dword [esp + 0x14], ebx
je 0x4089d9
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x2e]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x37]
push eax
lea eax, [esp + 0x1d]
push eax
lea eax, [esp + 0x23]
push eax
lea eax, [esp + 0x26]
push eax
lea eax, [esp + 0x27]
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x2e]
push eax
call fcn.00408510
add esp, 0x24
cmp byte [esp + 0xf], bl
je 0x408a2b
call fcn.004086f9
movzx eax, al
neg eax
sbb eax, eax
and eax, 0xfffffff3
add eax, 0xd
jmp 0x408f8d
cmp byte [esp + 0xe], bl
jne 0x408a50
push dword [esp + 0x1c]
push ebx
push str.ST_INVALID_COMMAND
push str.FAILED
call fcn.0040976f
add esp, 0x10
push 0x66
pop eax
jmp 0x408f8d
cmp byte [esp + 0x1a], bl
jne 0x408a67
push dword [esp + 0x1c]
push ebx
push str.ST_NOT_ADMIN
push str.REQUIREMENTS
jmp 0x408a40
push 0xff
lea eax, [esp + 0x7d]
push ebx
push eax
mov byte [esp + 0x84], bl
call fcn.00456240
lea eax, [esp + 0x84]
mov dword [0x476040], eax
lea eax, [esp + 0x80]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x27]
mov dword [esp + 0x40], eax
add esp, 0xc
lea eax, [esp + 0x78]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x14]
push eax
push ebx
lea eax, [esp + 0x38]
push eax
push 0x4087f5
push ebx
push ebx
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x33], bl
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, ebx
je 0x408ae5
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x10], bl
je 0x408b00
cmp byte [esp + 0x1b], bl
jne 0x408b00
push dword [esp + 0x1c]
push ebx
push str.ST_INVALID_PROCESS
jmp 0x408a3b
call fcn.004023dd
mov dword [esp + 0x14], eax
cmp eax, ebx
jne 0x408b1c
push dword [esp + 0x1c]
push ebx
push str.ST_ARCHIVE_DAMAGED
jmp 0x408a3b
push str.AppDataLocal
push eax
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.004084e1
mov esi, eax
mov edi, 0xf0000
pop ecx
mov dword [esp + 0x64], esi
and esi, edi
pop ecx
xor eax, eax
mov ecx, esi
or ecx, eax
mov dword [esp + 0x64], edx
mov dword [esp + 0x30], esi
jne 0x408d97
call fcn.00409db1
test al, al
je 0x408d97
call fcn.00409f42
test al, al
je 0x408d97
cmp byte [esp + 0x11], bl
je 0x408bd8
call fcn.00407f0d
push eax
call fcn.004017e0
mov dword [esp], 0x46beac
push dword [esp + 0x18]
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], edx
call fcn.004084e1
mov dword [esp + 0x58], eax
and eax, edi
or eax, ebx
pop ecx
pop ecx
mov esi, edx
jne 0x408bd8
call fcn.0040824e
test al, al
je 0x408bd8
or dword [esp + 0x50], 0x10
mov dword [esp + 0x54], esi
cmp byte [esp + 0x1c], bl
je 0x408bd8
cmp word [esp + 0x40], 9
jb 0x408bd8
call fcn.004080e3
cmp byte [esp + 0x12], bl
je 0x408c36
push str.firefox.exe
call fcn.0040861c
pop ecx
push dword [esp + 0x14]
mov dword [esp + 0x60], eax
call fcn.004079a8
mov dword [esp + 0x4c], eax
and eax, edi
or eax, ebx
pop ecx
mov esi, edx
jne 0x408c2b
call fcn.00407546
push eax
call fcn.004017e0
pop ecx
mov dword [esp + 0x44], edx
cmp ax, 8
jb 0x408c22
call fcn.004079fe
test al, al
je 0x408c2b
or dword [esp + 0x48], 0x10
mov dword [esp + 0x4c], esi
cmp dword [esp + 0x5c], ebx
jne 0x408c36
call fcn.00407ea4
cmp byte [esp + 0x13], bl
je 0x408d93
push str.chrome.exe
call fcn.0040861c
pop ecx
mov dword [esp + 0x5c], eax
call fcn.00406fe0
cmp eax, ebx
jne 0x408c66
mov dword [esp + 0x20], 0x20000
mov dword [esp + 0x24], ebx
jmp 0x408c7d
mov ecx, dword [esp + 0x14]
push eax
push 0x46ba40
call fcn.00401fe2
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x20]
and eax, edi
or eax, ebx
jne 0x408d88
call fcn.00407056
mov dword [esp + 0x14], eax
cmp eax, ebx
jne 0x408ca4
push ebx
call fcn.00450117
pop ecx
jmp 0x408d88
call fcn.00406e8a
mov esi, eax
cmp esi, ebx
jne 0x408cb5
push dword [esp + 0x14]
jmp 0x408c99
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._bprotectorpreferences
lea eax, [esp + 0x88]
push esi
push eax
call fcn.004054e9
add esp, 0x24
cmp dword [esp + 0x6c], ebx
jne 0x408ce6
mov esi, dword [esp + 0x70]
cmp esi, ebx
je 0x408caf
call fcn.00401000
jmp 0x408caf
push ebx
push dword [esp + 0x70]
call fcn.0045900a
pop ecx
pop ecx
test eax, eax
jne 0x408d10
push str.BPC1
call fcn.00409609
pop ecx
push dword [esp + 0x14]
push dword [esp + 0x70]
call fcn.004070f0
pop ecx
pop ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str.Preferences
lea eax, [esp + 0x5c]
push esi
push eax
call fcn.004054e9
add esp, 0x24
cmp dword [esp + 0x40], ebx
jne 0x408d3e
mov esi, dword [esp + 0x44]
cmp esi, ebx
je 0x408cd7
call fcn.00401000
jmp 0x408cd7
push dword [esp + 0x14]
push dword [esp + 0x44]
call fcn.004070f0
mov esi, dword [esp + 0x4c]
pop ecx
pop ecx
mov byte [esp + 0x1a], al
cmp esi, ebx
je 0x408d5e
call fcn.00401000
mov esi, dword [esp + 0x70]
cmp esi, ebx
je 0x408d6b
call fcn.00401000
push dword [esp + 0x14]
call fcn.00450117
pop ecx
cmp byte [esp + 0x1a], bl
je 0x408d88
mov eax, dword [esp + 0x24]
or dword [esp + 0x20], 0x10
mov dword [esp + 0x24], eax
cmp dword [esp + 0x5c], ebx
jne 0x408d93
call fcn.004074dd
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x48]
mov eax, ecx
and eax, edi
mov dword [esp + 0x30], eax
jne 0x408dc3
cmp ebx, ebx
jne 0x408dc3
mov eax, ecx
and eax, 0x10
mov dword [esp + 0x30], eax
jne 0x408dbc
cmp ebx, ebx
je 0x408dc3
mov byte [esp + 0xe], 1
jmp 0x408dc7
mov byte [esp + 0xe], bl
mov eax, edx
and eax, edi
mov dword [esp + 0x30], eax
jne 0x408deb
cmp ebx, ebx
jne 0x408deb
mov eax, edx
and eax, 0x10
mov dword [esp + 0x30], eax
jne 0x408de4
cmp ebx, ebx
je 0x408deb
mov byte [esp + 0x10], 1
jmp 0x408def
mov byte [esp + 0x10], bl
mov eax, dword [esp + 0x20]
and eax, edi
mov dword [esp + 0x30], eax
jne 0x408e17
cmp ebx, ebx
jne 0x408e17
mov eax, dword [esp + 0x20]
and eax, 0x10
mov dword [esp + 0x30], eax
jne 0x408e10
cmp ebx, ebx
je 0x408e17
mov byte [esp + 0x11], 1
jmp 0x408e1b
mov byte [esp + 0x11], bl
cmp esi, ebx
jne 0x408e3d
xor eax, eax
cmp eax, ebx
jne 0x408e3d
cmp byte [esp + 0xe], bl
jne 0x408e37
cmp byte [esp + 0x10], bl
jne 0x408e37
cmp byte [esp + 0x11], bl
je 0x408e3d
mov byte [esp + 0x13], bl
jmp 0x408e42
mov byte [esp + 0x13], 1
xor eax, eax
mov esi, ecx
inc eax
and esi, eax
mov dword [esp + 0x30], esi
jne 0x408e89
cmp ebx, ebx
jne 0x408e89
mov esi, edx
and esi, eax
mov dword [esp + 0x30], esi
jne 0x408e89
cmp ebx, ebx
jne 0x408e89
mov esi, dword [esp + 0x20]
mov edi, esi
and edi, eax
mov dword [esp + 0x30], edi
jne 0x408e8d
cmp ebx, ebx
jne 0x408e8d
mov edi, dword [esp + 0x60]
and edi, eax
mov dword [esp + 0x30], edi
jne 0x408e8d
cmp ebx, ebx
jne 0x408e8d
mov byte [esp + 0xf], bl
jmp 0x408e92
mov esi, dword [esp + 0x20]
mov byte [esp + 0xf], 1
push 8
pop edi
and ecx, edi
mov dword [esp + 0x30], ecx
jne 0x408ecd
cmp ebx, ebx
jne 0x408ecd
and edx, edi
mov dword [esp + 0x30], edx
jne 0x408ecd
cmp ebx, ebx
jne 0x408ecd
and esi, edi
mov dword [esp + 0x30], esi
jne 0x408ecd
cmp ebx, ebx
jne 0x408ecd
mov ecx, dword [esp + 0x60]
and ecx, edi
mov dword [esp + 0x30], ecx
jne 0x408ecd
mov byte [esp + 0x12], bl
cmp ebx, ebx
je 0x408ed2
mov byte [esp + 0x12], 1
push 0x64
pop edi
cmp byte [esp + 0x13], bl
jne 0x408f71
call fcn.00409c28
mov eax, 0x46c12a
mov esi, 0x46bf80
cmp byte [esp + 0x11], bl
jne 0x408ef6
mov esi, eax
mov edx, 0x46bf84
cmp byte [esp + 0x10], bl
jne 0x408f03
mov edx, eax
cmp byte [esp + 0xe], bl
je 0x408f0e
mov eax, 0x46bf88
mov ecx, str.ST_DUPLICATE
cmp byte [esp + 0xf], bl
jne 0x408f1e
mov ecx, str.ST_OK
push ebx
push ebx
push ebx
push ebx
push esi
push edx
push eax
push ecx
lea eax, [esp + 0x80]
push eax
call fcn.004054e9
add esp, 0x24
mov eax, str.DUPLICATED
cmp byte [esp + 0xf], bl
jne 0x408f46
mov eax, 0x46b8d0
push dword [esp + 0x1c]
push 1
push dword [esp + 0x68]
push eax
call fcn.0040976f
add esp, 0x10
cmp byte [esp + 0x12], bl
je 0x408f62
push 0x6b
pop edi
mov esi, dword [esp + 0x64]
cmp esi, ebx
je 0x408f8b
call fcn.00401000
jmp 0x408f8b
push dword [esp + 0x1c]
push eax
push str.ST_FAILED
push str.FAILED
call fcn.0040976f
add esp, 0x10
push 0x66
pop edi
mov eax, edi
mov ecx, dword [esp + 0x37c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004500ac
mov esp, ebp
pop ebp
ret 0x10