Function at 0x41467b
Capabilities:
Accept command line arguments
Check if file exists
Check os version
Contain obfuscated stackstrings
Create process on windows
Get file attributes
Get installed programs
Print debug messages
Resolve function by parsing pe exports
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5568db
mov eax, dword fs:[0]
push eax
sub esp, 0x698
mov eax, dword [0x5aff20]
xor eax, esp
mov dword [esp + 0x690], eax
push ebx
push esi
push edi
mov eax, dword [0x5aff20]
xor eax, esp
push eax
lea eax, [esp + 0x6a8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x24], eax
add eax, 0xb8
mov dword [esp + 0x18], ebx
cmp dword [eax], ebx
jne 0x417e1c
mov dword [eax], 1
mov dword [esp + 0x3c], eax
push str._r_n_r_ninstall_thread_begin_...
push ebx
mov dword [esp + 0x6b8], ebx
call fcn.004024ac
pop ecx
mov ecx, eax
call fcn.0040252f
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push 2
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push ebx
push 0x584fe6
lea ecx, [esp + 0x204]
mov dword [esp + 0x218], 0xf
mov dword [esp + 0x214], ebx
mov byte [esp + 0x204], bl
call fcn.00409b42
mov byte [esp + 0x6b0], 1
call fcn.0041d142
cmp byte [eax + 4], bl
je 0x414756
push 0x58791c
call fcn.0041d8a0
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x804
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push str.zh_cn
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x6e8], 2
mov esi, esp
mov dword [esp + 0x6c], esp
push str.LANG
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x704], 3
mov esi, esp
mov dword [esp + 0x7c], esp
push str.SoftwareMagicPlus
call fcn.0040829d
push ebx
mov byte [esp + 0x708], 4
call fcn.00402ced
pop ecx
mov ecx, SysReAllocString
mov byte [esp + 0x704], 1
call fcn.00402d1c
mov eax, dword [0x5b9698]
cmp eax, ebx
jne 0x414811
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x20], eax
mov byte [esp + 0x6b0], 5
cmp eax, ebx
je 0x414800
mov ebx, eax
call fcn.00404153
jmp 0x414802
xor eax, eax
mov byte [esp + 0x6b0], 1
mov dword [0x5b9698], eax
xor ebx, ebx
push eax
call fcn.00411c04
test eax, eax
je 0x414827
push ebx
call fcn.004033d6
pop ecx
call fcn.0040f99e
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x3c], esp
push 0x585164
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x6e8], 6
mov esi, esp
mov dword [esp + 0x6c], esp
push str.847A10EF_26BE_42D2_9FA1_158AAD29D3D9
call fcn.0040829d
push ebx
mov byte [esp + 0x6ec], 7
call fcn.004033a7
pop ecx
lea ecx, [esp + 0x250]
mov byte [esp + 0x6e8], 1
call fcn.0040ea3f
push ebx
mov byte [esp + 0x6b4], 8
call fcn.004033a7
pop ecx
lea ecx, [esp + 0x138]
call fcn.0040e95d
xor eax, eax
mov byte [esp + 0x6b0], 9
cmp eax, dword [esp + 0x228]
sbb eax, eax
neg eax
mov dword [esp + 0x34], eax
xor eax, eax
cmp eax, dword [esp + 0x148]
sbb eax, eax
neg eax
mov dword [esp + 0x28], eax
je 0x414a83
mov eax, dword [0x5b9698]
cmp eax, ebx
jne 0x4148fe
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x20], eax
mov byte [esp + 0x6b0], 0xa
cmp eax, ebx
je 0x4148ed
mov ebx, eax
call fcn.00404153
jmp 0x4148ef
xor eax, eax
mov byte [esp + 0x6b0], 9
mov dword [0x5b9698], eax
xor ebx, ebx
push 1
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x40], esp
push str.AddToScheduleAutoRun
mov edi, eax
call fcn.0040829d
mov ecx, edi
call fcn.00411a47
cmp eax, ebx
je 0x414a83
push ebx
call fcn.004024ac
pop ecx
push eax
mov ebx, str.001_remove_task_sh_begin
call fcn.0040c7b8
xor esi, esi
mov dword [esp + 0x48], vtable.CDllPromptHelper.0
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], esi
lea eax, [esp + 0x48]
mov byte [esp + 0x6b0], 0xb
call fcn.0040f716
push esi
call fcn.004024ac
pop ecx
push eax
mov ebx, str.002_delete_service_begin
call fcn.0040c7b8
lea eax, [esp + 0x88]
push str.MagicPlusService.exe
push eax
lea ebx, [esp + 0x140]
call fcn.0040ae0a
pop ecx
pop ecx
mov byte [esp + 0x6b0], 0xc
cmp dword [esp + 0x9c], 8
mov eax, dword [esp + 0x88]
jae 0x4149b6
lea eax, [esp + 0x88]
xor edi, edi
push edi
push eax
call fcn.00522f0f
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x414a5a
push edi
push 1
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x44], esp
push str._uninstall
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x6f0], 0xd
lea eax, [esp + 0xc8]
mov esi, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.00408277
sub esp, 0x1c
mov byte [esp + 0x70c], 0xe
lea eax, [esp + 0x194]
mov esi, esp
mov dword [esp + 0x6c], esp
push eax
call fcn.00408277
mov byte [esp + 0x70c], 0xf
cmp dword [0x5b967c], edi
jne 0x414a4d
push 1
call fcn.00423341
pop ecx
mov ecx, eax
cmp ecx, edi
je 0x414a47
xor eax, eax
mov edi, ecx
stosb byte es:[edi], al
mov dword [0x5b967c], ecx
jmp 0x414a4d
mov dword [0x5b967c], edi
mov byte [esp + 0x70c], 0xc
call fcn.0040cb9a
push 1
xor edi, edi
lea esi, [esp + 0x8c]
mov byte [esp + 0x6b4], 0xb
call fcn.00409659
lea ecx, [esp + 0x48]
mov byte [esp + 0x6b0], 9
call fcn.0040f4a5
mov eax, dword [0x5b9698]
test eax, eax
jne 0x414abc
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x6b0], 0x10
test eax, eax
je 0x414aad
mov ebx, eax
call fcn.00404153
jmp 0x414aaf
xor eax, eax
mov byte [esp + 0x6b0], 9
mov dword [0x5b9698], eax
push 1
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.AddToWindowFireWallList
mov edi, eax
call fcn.0040829d
mov ecx, edi
call fcn.00411a47
test eax, eax
je 0x414caa
push 0
call fcn.004024ac
pop ecx
push eax
mov ebx, str.003_remove_filewall_begin
call fcn.0040c7b8
xor esi, esi
push esi
call fcn.004033d6
pop ecx
push esi
call fcn.004033a7
pop ecx
lea ecx, [esp + 0x48]
call fcn.0040e95d
mov byte [esp + 0x6b0], 0x11
mov eax, dword [esp + 0x58]
cmp eax, 1
jb 0x414c95
cmp eax, esi
jbe 0x414b48
lea ecx, [eax - 1]
lea eax, [esp + 0x48]
call fcn.0041a1ec
cmp word [eax], 0x5c
je 0x414b48
push 0x585004
lea eax, [esp + 0x4c]
push eax
call fcn.004082e5
cmp dword [esp + 0x58], esi
je 0x414c95
mov dword [esp + 0x1c], esi
lea ecx, [esp + 0x1c]
mov byte [esp + 0x6b0], 0x12
call fcn.0040c361
lea eax, [esp + 0xdc]
push 0x585148
push eax
lea ebx, [esp + 0x50]
mov byte [esp + 0x6b8], 0x13
call fcn.0040ae0a
lea eax, [esp + 0x90]
push str.crashsender.exe
push eax
mov byte [esp + 0x6c0], 0x14
call fcn.0040ae0a
lea eax, [esp + 0xb4]
push str.MagicPlus_helper.exe
push eax
mov byte [esp + 0x6c8], 0x15
call fcn.0040ae0a
add esp, 0x18
mov byte [esp + 0x6b0], 0x16
cmp dword [esp + 0xf0], 8
mov ecx, dword [esp + 0xdc]
jae 0x414bdc
lea ecx, [esp + 0xdc]
lea edx, [esp + 0x1c]
call fcn.0040c26c
cmp dword [esp + 0xb8], 8
mov ecx, dword [esp + 0xa4]
jae 0x414bfd
lea ecx, [esp + 0xa4]
lea edx, [esp + 0x1c]
call fcn.0040c26c
cmp dword [esp + 0x9c], 8
mov ecx, dword [esp + 0x88]
jae 0x414c1e
lea ecx, [esp + 0x88]
lea edx, [esp + 0x1c]
call fcn.0040c26c
xor ebx, ebx
inc ebx
push ebx
xor edi, edi
lea esi, [esp + 0xa8]
mov byte [esp + 0x6b4], 0x15
call fcn.00409659
push ebx
lea esi, [esp + 0x8c]
mov byte [esp + 0x6b4], 0x14
call fcn.00409659
push ebx
lea esi, [esp + 0xe0]
mov byte [esp + 0x6b4], 0x13
call fcn.00409659
lea ecx, [esp + 0x1c]
mov byte [esp + 0x6b0], 0x17
call fcn.0040c436
mov byte [esp + 0x6b0], 0x11
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x414c92
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push ebx
jmp 0x414c97
push 1
xor edi, edi
lea esi, [esp + 0x4c]
mov byte [esp + 0x6b4], 9
call fcn.00409659
mov eax, dword [0x5b9698]
test eax, eax
jne 0x414ce3
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x6b0], 0x18
test eax, eax
je 0x414cd4
mov ebx, eax
call fcn.00404153
jmp 0x414cd6
xor eax, eax
mov byte [esp + 0x6b0], 9
mov dword [0x5b9698], eax
push 1
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.WriteAutoRunRegistery
mov edi, eax
call fcn.0040829d
mov ecx, edi
call fcn.00411a47
test eax, eax
je 0x414d78
push 0
call fcn.004024ac
pop ecx
push eax
mov ebx, str.004_delete_auto_run_begin
call fcn.0040c7b8
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x2c], esp
push str.MagicPlusHelper
call fcn.0040829d
push 0
mov byte [esp + 0x6d0], 0x19
call fcn.004033a7
pop ecx
mov byte [esp + 0x6cc], 9
call fcn.0040ecd5
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x2c], esp
push str.MagicPlus_helper
call fcn.0040829d
push 0
mov byte [esp + 0x6d0], 0x1a
call fcn.004033a7
pop ecx
mov byte [esp + 0x6cc], 9
call fcn.0040ecd5
mov eax, dword [0x5b9698]
test eax, eax
jne 0x414db1
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x6b0], 0x1b
test eax, eax
je 0x414da2
mov ebx, eax
call fcn.00404153
jmp 0x414da4
xor eax, eax
mov byte [esp + 0x6b0], 9
mov dword [0x5b9698], eax
push eax
call fcn.00411bde
test eax, eax
je 0x414e8d
push 0
call fcn.004024ac
pop ecx
push eax
mov ebx, str.005_kill_process_begin
call fcn.0040c7b8
xor esi, esi
push esi
call fcn.004033d6
pop ecx
call fcn.004101cb
test eax, eax
jne 0x414e7b
call fcn.0041464f
push esi
call fcn.004033d6
pop ecx
call fcn.004101cb
push esi
test eax, eax
jne 0x414e68
call fcn.004024ac
pop ecx
push eax
mov ebx, str.006_call_MyTerminateExes_secondly_error_
call fcn.0040c7b8
push 1
xor edi, edi
lea esi, [esp + 0x13c]
mov byte [esp + 0x6b4], 8
call fcn.00409659
push 1
lea esi, [esp + 0x21c]
mov byte [esp + 0x6b4], 1
call fcn.00409659
xor ebx, ebx
push ebx
push 1
lea ecx, [esp + 0x204]
mov byte [esp + 0x6b8], bl
call fcn.0040933f
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x417e1c
mov dword [eax], ebx
jmp 0x417e1c
call fcn.004024ac
pop ecx
push eax
mov ebx, str.007_call_MyTerminateExes_secondly_success_
call fcn.0040c7b8
xor esi, esi
push esi
call fcn.004024ac
pop ecx
push eax
mov ebx, str.008_kill_process_end
call fcn.0040c7b8
push 0
call fcn.00402a06
pop ecx
push 0xa5
lea eax, [esp + 0x158]
push eax
call fcn.00402a35
mov byte [esp + 0x6b0], 0x1c
cmp dword [esp + 0x164], 1
jae 0x414ecd
push 6
pop eax
mov ecx, str.Kb:g
lea esi, [esp + 0x154]
call fcn.00409cec
mov eax, dword [0x5b9698]
test eax, eax
jne 0x414f06
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x6b0], 0x1d
test eax, eax
je 0x414ef7
mov ebx, eax
call fcn.00404153
jmp 0x414ef9
xor eax, eax
mov byte [esp + 0x6b0], 0x1c
mov dword [0x5b9698], eax
push 1
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.WriteDesktopLink
mov edi, eax
call fcn.0040829d
mov ecx, edi
call fcn.00411a47
test eax, eax
jne 0x414f87
mov eax, dword [0x5b9698]
test eax, eax
jne 0x414f61
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x6b0], 0x1e
test eax, eax
je 0x414f52
mov ebx, eax
call fcn.00404153
jmp 0x414f54
xor eax, eax
mov byte [esp + 0x6b0], 0x1c
mov dword [0x5b9698], eax
push 1
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.WriteStartupMenuLink
mov edi, eax
call fcn.0040829d
mov ecx, edi
call fcn.00411a47
test eax, eax
je 0x415016
push 0
call fcn.004024ac
pop ecx
push eax
mov ebx, str.009_delete_link_icon_begin
call fcn.0040c7b8
push 0
call fcn.004033d6
pop ecx
call fcn.004107ff
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x2c], esp
mov esi, str..lnk
push esi
push eax
lea ebx, [esp + 0x178]
call fcn.0040ae0a
push 0
mov byte [esp + 0x6d8], 0x1f
call fcn.00402c67
add esp, 0xc
push 0x19
pop ecx
mov byte [esp + 0x6cc], 0x1c
call fcn.0040d506
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x2c], esp
push esi
push eax
call fcn.0040ae0a
push 0
mov byte [esp + 0x6d8], 0x20
call fcn.00402c67
add esp, 0xc
xor ecx, ecx
mov byte [esp + 0x6cc], 0x1c
call fcn.0040d506
mov eax, dword [0x5b9698]
test eax, eax
jne 0x41504f
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x6b0], 0x21
test eax, eax
je 0x415040
mov ebx, eax
call fcn.00404153
jmp 0x415042
xor eax, eax
mov byte [esp + 0x6b0], 0x1c
mov dword [0x5b9698], eax
push 1
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.WriteStartupMenuLockLink
mov edi, eax
call fcn.0040829d
mov ecx, edi
call fcn.00411a47
test eax, eax
je 0x4150e2
push 0
call fcn.004024ac
pop ecx
push eax
mov ebx, str.010_delLockIcon_menu_begin
call fcn.0040c7b8
cmp dword [esp + 0x14c], 8
mov edi, dword [esp + 0x138]
jae 0x41509c
lea edi, [esp + 0x138]
xor esi, esi
push esi
call fcn.00402c67
mov dword [esp], 0x585148
push edi
push 1
push esi
call fcn.0040d9d5
cmp dword [esp + 0x14c], 8
mov edi, dword [esp + 0x138]
jae 0x4150cc
lea edi, [esp + 0x138]
push esi
call fcn.00402c67
mov dword [esp], str.MobileRes.exe
push edi
push 1
push esi
call fcn.0040d9d5
xor esi, esi
cmp dword [0x5b9698], esi
jne 0x41511e
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x6b0], 0x22
cmp eax, esi
je 0x41510d
mov ebx, eax
call fcn.00404153
jmp 0x41510f
xor eax, eax
mov byte [esp + 0x6b0], 0x1c
mov dword [0x5b9698], eax
xor esi, esi
mov eax, dword [0x5b968c]
cmp eax, esi
jne 0x415159
push 0x90
call fcn.00423341
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x6b0], 0x23
cmp eax, esi
je 0x41514a
push eax
call fcn.004032d4
jmp 0x41514c
xor eax, eax
mov byte [esp + 0x6b0], 0x1c
mov dword [0x5b968c], eax
cmp dword [eax], esi
je 0x415171
mov eax, dword [esp + 0x24]
push esi
push esi
push 0x4cc
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call fcn.004024ac
pop ecx
push eax
mov ebx, str.012_delete_old_dir_begin
call fcn.0040c7b8
mov eax, dword [0x5b9698]
xor esi, esi
cmp eax, esi
jne 0x4151c0
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x6b0], 0x24
cmp eax, esi
je 0x4151af
mov ebx, eax
call fcn.00404153
jmp 0x4151b1
xor eax, eax
mov byte [esp + 0x6b0], 0x1c
mov dword [0x5b9698], eax
xor esi, esi
push eax
call fcn.00411bde
test eax, eax
je 0x415667
cmp dword [esp + 0x34], esi
je 0x4153a6
cmp dword [esp + 0x28], esi
je 0x4154a1
cmp dword [esp + 0x14c], 8
mov eax, dword [esp + 0x138]
jae 0x4151fa
lea eax, [esp + 0x138]
push esi
push eax
call fcn.00522f0f
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x4153a6
push esi
call fcn.004024ac
pop ecx
push eax
mov ebx, str.013_call_old_version_msi_uninstall_begin
call fcn.0040c7b8
xor ebx, ebx
push ebx
call fcn.004033d6
pop ecx
push 1
call fcn.0040ff3b
lea eax, [esp + 0x64]
push 0x587be0
push eax
lea edi, [esp + 0x220]
call fcn.0040ae78
push str.__quiet__norestart
push eax
lea eax, [esp + 0xb4]
mov byte [esp + 0x6c0], 0x25
call fcn.0040adbd
add esp, 0x10
push 1
xor edi, edi
lea esi, [esp + 0x68]
mov byte [esp + 0x6b4], 0x27
call fcn.00409659
mov eax, dword [0x5b968c]
cmp eax, ebx
jne 0x4152b1
push 0x90
call fcn.00423341
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x6b0], 0x28
cmp eax, ebx
je 0x4152a2
push eax
call fcn.004032d4
jmp 0x4152a4
xor eax, eax
mov byte [esp + 0x6b0], 0x27
mov dword [0x5b968c], eax
cmp dword [eax], ebx
je 0x4152c9
mov eax, dword [esp + 0x24]
push ebx
push ebx
push 0x4cb
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 0xb8], 8
mov eax, dword [esp + 0xa4]
push ebx
push 1
jae 0x4152e4
lea eax, [esp + 0xac]
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x34], esp
push eax
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x6f0], 0x29
mov esi, esp
mov dword [esp + 0x60], esp
push str.msiexec
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x70c], 0x2a
mov esi, esp
mov dword [esp + 0x90], esp
push 0x585d54
call fcn.0040829d
mov byte [esp + 0x70c], 0x2b
cmp dword [0x5b967c], ebx
jne 0x41535d
push 1
call fcn.00423341
pop ecx
mov ecx, eax
cmp ecx, ebx
je 0x415357
xor eax, eax
mov edi, ecx
stosb byte es:[edi], al
mov dword [0x5b967c], ecx
jmp 0x41535d
mov dword [0x5b967c], ebx
mov byte [esp + 0x70c], 0x27
call fcn.0040cb9a
push ebx
call fcn.004033d6
pop ecx
push ebx
call fcn.0040ff3b
push ebx
call fcn.004024ac
pop ecx
push eax
mov ebx, str.014_call_old_version_msi_uninstall_end
call fcn.0040c7b8
push 1
xor edi, edi
lea esi, [esp + 0xa8]
mov byte [esp + 0x6b4], 0x1c
call fcn.00409659
jmp 0x4154a1
cmp dword [esp + 0x28], esi
je 0x4154a1
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call edi
push esi
call fcn.004024ac
pop ecx
push eax
mov ebx, str.015_delete_old_version_dir_begin
call fcn.0040c7b8
xor ebx, ebx
sub esp, 0x1c
lea eax, [esp + 0x154]
mov esi, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00408277
push 0
mov byte [esp + 0x6d0], 0x2c
call fcn.00402c67
pop ecx
push eax
mov byte [esp + 0x6d0], 0x1c
call fcn.0040df09
test eax, eax
jne 0x4154a1
mov eax, ebx
inc ebx
cmp eax, 3
jg 0x415418
push 0x32
call edi
jmp 0x4153ce
push 0
call fcn.004024ac
pop ecx
push eax
mov ebx, str.016_delete_old_version_dir_fail____
call fcn.0040c7b8
xor edi, edi
push edi
call fcn.004033d6
pop ecx
call fcn.004101cb
cmp dword [esp + 0x14c], 8
mov eax, dword [esp + 0x138]
jae 0x415451
lea eax, [esp + 0x138]
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.0040829d
push edi
mov byte [esp + 0x6d0], 0x2d
call fcn.00402c67
pop ecx
mov ecx, eax
mov byte [esp + 0x6cc], 0x1c
call fcn.0040e01f
push edi
cmp eax, 1
jne 0x415490
call fcn.004024ac
mov ebx, str.017_delete_old_version_dir_2_success
jmp 0x41549a
call fcn.004024ac
mov ebx, str.018_delete_old_version_dir_2_fail____
pop ecx
push eax
call fcn.0040c7b8
mov eax, dword [0x5b9698]
test eax, eax
jne 0x4154da
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x6b0], 0x2e
test eax, eax
je 0x4154cb
mov ebx, eax
call fcn.00404153
jmp 0x4154cd
xor eax, eax
mov byte [esp + 0x6b0], 0x1c
mov dword [0x5b9698], eax
push eax
call fcn.00411c76
test eax, eax
je 0x4154fc
push 0
call fcn.004024ac
pop ecx
push eax
mov ebx, str.019_remove_old_icon_below_mycomputer_begin
call fcn.0040c7b8
call fcn.00410c47
mov eax, dword [0x5b9698]
test eax, eax
jne 0x415535
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x6b0], 0x2f
test eax, eax
je 0x415526
mov ebx, eax
call fcn.00404153
jmp 0x415528
xor eax, eax
mov byte [esp + 0x6b0], 0x1c
mov dword [0x5b9698], eax
push eax
call fcn.00411c04
test eax, eax
je 0x4155eb
push 0
call fcn.004024ac
pop ecx
push eax
mov ebx, str.020_delete_install_dir_begin
call fcn.0040c7b8
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x2c], esp
mov edi, 0x585164
push edi
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x6e8], 0x30
mov esi, esp
mov dword [esp + 0x58], esp
push str.SOFTWARE
call fcn.0040829d
push 0
mov byte [esp + 0x6ec], 0x31
call fcn.00402ced
pop ecx
push eax
mov byte [esp + 0x6ec], 0x1c
call fcn.00402f05
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x2c], esp
push edi
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x6e8], 0x32
mov esi, esp
mov dword [esp + 0x58], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
call fcn.0040829d
push 0
mov byte [esp + 0x6ec], 0x33
call fcn.00402ced
pop ecx
push eax
mov byte [esp + 0x6ec], 0x1c
call fcn.00402f05
mov eax, dword [0x5b9698]
test eax, eax
jne 0x415624
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x6b0], 0x34
test eax, eax
je 0x415615
mov ebx, eax
call fcn.00404153
jmp 0x415617
xor eax, eax
mov byte [esp + 0x6b0], 0x1c
mov dword [0x5b9698], eax
push eax
call fcn.00411c76
test eax, eax
je 0x415667
push 0
call fcn.004024ac
pop ecx
push eax
mov ebx, str.021_remove_icon_below_mycomputer_begin
call fcn.0040c7b8
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x2c], esp
call fcn.00410bf9
call fcn.00411070
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x2c], esp
call fcn.00410c13
call fcn.00411070
mov eax, dword [0x5b9698]
test eax, eax
jne 0x4156a0
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x6b0], 0x35
test eax, eax
je 0x415691
mov ebx, eax
call fcn.00404153
jmp 0x415693
xor eax, eax
mov byte [esp + 0x6b0], 0x1c
mov dword [0x5b9698], eax
push eax
call fcn.00411c2a
test eax, eax
je 0x4156f5
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x2c], esp
push str.OldAppUpdateCount
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x6e8], 0x36
mov esi, esp
mov dword [esp + 0x58], esp
push str.SoftwareLenovoMagicPlus
call fcn.0040829d
push 0
mov byte [esp + 0x6ec], 0x37
call fcn.00402ced
pop ecx
mov byte [esp + 0x6e8], 0x1c
call fcn.0040e7f0
push 0
call fcn.004024ac
pop ecx
push eax
mov ebx, str.022_the_uninstall_finished_now_begin_install
call fcn.0040c7b8
push 0
call fcn.00402a06
pop ecx
push 0xb4
lea eax, [esp + 0xfc]
push eax
call fcn.00402a35
push 0
mov byte [esp + 0x6b4], 0x38
call fcn.00401edb
pop ecx
lea ecx, [esp + 0x250]
call fcn.00401fd9
lea eax, [esp + 0x1c4]
push str.contents.cab
push eax
lea ebx, [esp + 0x258]
mov byte [esp + 0x6b8], 0x39
call fcn.0040ae0a
lea eax, [esp + 0x1e8]
push str.ini.cab
push eax
mov byte [esp + 0x6c0], 0x3a
call fcn.0040ae0a
push 0
mov byte [esp + 0x6c4], 0x3b
call fcn.004024ac
add esp, 0x14
push eax
mov ebx, str.023_extrac_cab_file_from_res_begin
call fcn.0040c7b8
sub esp, 0x1c
lea eax, [esp + 0x1e0]
mov esi, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00408277
sub esp, 0x1c
mov byte [esp + 0x6e8], 0x3c
mov esi, esp
mov dword [esp + 0x58], esp
mov edi, 0x5859d8
push edi
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x704], 0x3d
mov esi, esp
mov dword [esp + 0x88], esp
push str.151
call fcn.0040829d
mov byte [esp + 0x704], 0x3e
call fcn.0042ead1
mov esi, dword [eax + 8]
xor ebx, ebx
push ebx
call fcn.00402a06
pop ecx
mov ecx, esi
mov byte [esp + 0x704], 0x3b
call fcn.00402b7a
sub esp, 0x1c
lea eax, [esp + 0x1fc]
mov esi, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00408277
mov byte [esp + 0x6cc], 0x3f
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x58], esp
push edi
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x704], 0x40
mov esi, esp
mov dword [esp + 0x88], esp
push str.209
call fcn.0040829d
mov byte [esp + 0x704], 0x41
call fcn.0042ead1
mov esi, dword [eax + 8]
push ebx
call fcn.00402a06
pop ecx
mov ecx, esi
mov byte [esp + 0x704], 0x3b
call fcn.00402b7a
push ebx
call fcn.004024ac
pop ecx
push eax
mov ebx, str.024_extrac_cab_file_from_res_end
call fcn.0040c7b8
mov eax, dword [0x5b968c]
xor ebx, ebx
cmp eax, ebx
jne 0x4158ce
push 0x90
call fcn.00423341
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x6b0], 0x42
cmp eax, ebx
je 0x4158bf
push eax
call fcn.004032d4
jmp 0x4158c1
xor eax, eax
mov byte [esp + 0x6b0], 0x3b
mov dword [0x5b968c], eax
lea ecx, [esp + 0x18c]
call fcn.0040e8b0
push ebx
mov byte [esp + 0x6b4], 0x43
call fcn.004033a7
pop ecx
lea eax, [esp + 0x3bc]
push eax
call fcn.0040e8fb
mov byte [esp + 0x6b0], 0x44
cmp dword [eax + 0x14], 8
jb 0x415908
mov esi, dword [eax]
jmp 0x41590a
mov esi, eax
push ebx
call fcn.00401edb
pop ecx
push esi
lea ecx, [esp + 0x388]
call fcn.004021b9
push 1
xor edi, edi
lea esi, [esp + 0x3c0]
mov byte [esp + 0x6b4], 0x46
call fcn.00409659
push ebx
call fcn.004024ac
pop ecx
push eax
mov ebx, str.025_before_extrac_cab_file
call fcn.0040c7b8
and dword [esp + 0x28], edi
push 0
call fcn.004033a7
pop ecx
lea eax, [esp + 0x170]
push eax
call fcn.0040e8fb
push 8
pop ecx
mov byte [esp + 0x6b0], 0x47
cmp dword [eax + 0x14], ecx
jb 0x415973
mov eax, dword [eax]
mov edi, dword [esp + 0x1e0]
cmp dword [esp + 0x1f4], ecx
jae 0x41598a
lea edi, [esp + 0x1e0]
mov esi, dword [esp + 0x1c4]
cmp dword [esp + 0x1d8], ecx
jae 0x4159a1
lea esi, [esp + 0x1c4]
cmp dword [esp + 0x10c], ecx
mov ecx, dword [esp + 0xf8]
jae 0x4159b8
lea ecx, [esp + 0xf8]
push edi
push esi
push ecx
mov edx, eax
lea ecx, [esp + 0x278]
call fcn.0040568b
push 1
xor edi, edi
lea esi, [esp + 0x174]
mov byte [esp + 0x6b4], 0x49
call fcn.00409659
push edi
call fcn.004024ac
pop ecx
push eax
mov ebx, str.026_before_extrac_cab_file_1
call fcn.0040c7b8
mov eax, dword [0x5b9698]
test eax, eax
jne 0x415a2c
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x6b0], 0x4a
test eax, eax
je 0x415a1d
mov ebx, eax
call fcn.00404153
jmp 0x415a1f
xor eax, eax
mov byte [esp + 0x6b0], 0x49
mov dword [0x5b9698], eax
push eax
call fcn.00411bde
test eax, eax
je 0x415ac2
lea eax, [esp + 0x26c]
push eax
call fcn.00405a9a
cmp dword [esp + 0x318], 8
mov ebx, dword [esp + 0x304]
jae 0x415a5f
lea ebx, [esp + 0x304]
lea edi, [esp + 0x3d8]
call fcn.00404fce
mov byte [esp + 0x6b0], 0x4b
cmp dword [esp + 0x2b8], 8
mov eax, dword [esp + 0x2a4]
jae 0x415a8b
lea eax, [esp + 0x2a4]
mov ecx, dword [esp + 0x3f8]
test ecx, ecx
je 0x415aae
lea edx, [esp + 0x26c]
push edx
push 0x4065d3
push 0x4065ce
push eax
call fcn.00405411
lea ecx, [esp + 0x3d8]
mov byte [esp + 0x6b0], 0x49
call fcn.0040500b
mov eax, dword [0x5b9698]
test eax, eax
jne 0x415afb
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x6b0], 0x4c
test eax, eax
je 0x415aec
mov ebx, eax
call fcn.00404153
jmp 0x415aee
xor eax, eax
mov byte [esp + 0x6b0], 0x49
mov dword [0x5b9698], eax
xor ebx, ebx
inc ebx
push ebx
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.InstallKeysInRegister
mov edi, eax
call fcn.0040829d
mov ecx, edi
call fcn.00411a47
test eax, eax
je 0x416185
push 0x585d54
lea esi, [esp + 0x118]
call fcn.0040829d
mov byte [esp + 0x6b0], 0x4d
cmp dword [esp + 0x29c], ebx
jae 0x415b4b
push ebx
jmp 0x415f8c
cmp dword [esp + 0x28c], ebx
jb 0x415b45
lea eax, [esp + 0x434]
push eax
call fcn.00413d1a
lea ebx, [esp + 0x434]
mov byte [esp + 0x6b0], 0x4e
call fcn.00411ff4
push str.Manufacturer
lea esi, [esp + 0x68]
call fcn.0040829d
mov eax, esi
push eax
lea eax, [esp + 0x24]
push eax
lea edi, [esp + 0x29c]
mov byte [esp + 0x6b8], 0x4f
call fcn.00408f0a
mov ebx, dword [eax]
push 1
xor edi, edi
mov byte [esp + 0x6b4], 0x4e
call fcn.00409659
cmp ebx, dword [esp + 0x298]
je 0x415bcd
push 0xffffffffffffffff
lea eax, [ebx + 0x28]
push edi
lea ecx, [esp + 0x5b4]
call fcn.0040946e
push str.ProductLanguage
lea esi, [esp + 0x68]
call fcn.0040829d
mov eax, esi
push eax
lea eax, [esp + 0x38]
push eax
lea edi, [esp + 0x29c]
mov byte [esp + 0x6b8], 0x50
call fcn.00408f0a
mov ebx, dword [eax]
push 1
xor edi, edi
mov byte [esp + 0x6b4], 0x4e
call fcn.00409659
cmp ebx, dword [esp + 0x298]
je 0x415c2c
lea eax, [ebx + 0x28]
cmp dword [eax + 0x14], 8
jb 0x415c1e
mov eax, dword [eax]
push eax
call fcn.005239a8
pop ecx
mov dword [esp + 0x56c], eax
push str.ProductName
lea esi, [esp + 0x68]
call fcn.0040829d
mov eax, esi
push eax
lea eax, [esp + 0x48]
push eax
lea edi, [esp + 0x29c]
mov byte [esp + 0x6b8], 0x51
call fcn.00408f0a
mov ebx, dword [eax]
push 1
xor edi, edi
mov byte [esp + 0x6b4], 0x4e
call fcn.00409659
cmp ebx, dword [esp + 0x298]
je 0x415c84
push 0xffffffffffffffff
lea eax, [ebx + 0x28]
push edi
lea ecx, [esp + 0x4ac]
call fcn.0040946e
push str.ProductVersion
lea esi, [esp + 0x68]
call fcn.0040829d
mov eax, esi
push eax
lea eax, [esp + 0x44]
push eax
lea edi, [esp + 0x29c]
mov byte [esp + 0x6b8], 0x52
call fcn.00408f0a
mov ebx, dword [eax]
push 1
xor edi, edi
mov byte [esp + 0x6b4], 0x4e
call fcn.00409659
cmp ebx, dword [esp + 0x298]
je 0x415cdc
push 0xffffffffffffffff
lea eax, [ebx + 0x28]
push edi
lea ecx, [esp + 0x4c8]
call fcn.0040946e
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x2ac]
lea ecx, [esp + 0x11c]
call fcn.0040946e
push str.ARPPRODUCTICON
lea esi, [esp + 0x68]
call fcn.0040829d
mov eax, esi
push eax
lea eax, [esp + 0x3c]
push eax
lea edi, [esp + 0x29c]
mov byte [esp + 0x6b8], 0x53
call fcn.00408f0a
mov ebx, dword [eax]
push 1
xor edi, edi
mov byte [esp + 0x6b4], 0x4e
call fcn.00409659
cmp ebx, dword [esp + 0x298]
je 0x415d79
lea eax, [esp + 0x114]
push eax
lea eax, [esp + 0x4c]
add ebx, 0x28
push eax
call fcn.0040af10
pop ecx
pop ecx
mov ebx, eax
lea eax, [esp + 0x488]
mov byte [esp + 0x6b0], 0x54
call fcn.00409383
push 1
lea esi, [esp + 0x4c]
mov byte [esp + 0x6b4], 0x4e
call fcn.00409659
push 0xffffffffffffffff
xor esi, esi
push esi
lea eax, [esp + 0x2f0]
lea ecx, [esp + 0x558]
call fcn.0040946e
cmp dword [esp + 0x2dc], 1
jae 0x415db1
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x4c8]
lea ecx, [esp + 0x2d4]
call fcn.0040946e
push esi
push 0x400
push dword [esp + 0x2d0]
push dword [esp + 0x2d0]
call fcn.0052acb0
mov dword [esp + 0x4dc], eax
mov dword [esp + 0x10], vtable.CInstall.0
lea eax, [esp + 0x64]
push str.MagicPlus_Uninstall.exe
push eax
lea ebx, [esp + 0x11c]
mov byte [esp + 0x6b8], 0x55
call fcn.0040ae0a
pop ecx
pop ecx
mov byte [esp + 0x6b0], 0x56
or dword [esp + 0x18], 2
mov ebx, eax
lea esi, [esp + 0xdc]
call fcn.004082bf
mov dword [esp + 0x6b0], 0x59
test byte [esp + 0x18], 4
je 0x415e3b
and dword [esp + 0x18], 0xfffffffb
push 1
xor edi, edi
lea esi, [esp + 0x41c]
call fcn.00409659
mov byte [esp + 0x6b0], 0x5a
test byte [esp + 0x18], 2
je 0x415e5c
and dword [esp + 0x18], 0xfffffffd
push 1
xor edi, edi
lea esi, [esp + 0x68]
call fcn.00409659
lea eax, [esp + 0x48]
push str.MagicPlus_Uninstall.exe
push eax
lea ebx, [esp + 0x11c]
call fcn.0040ae0a
pop ecx
pop ecx
mov byte [esp + 0x6b0], 0x5b
or dword [esp + 0x18], 8
mov ebx, eax
lea esi, [esp + 0x88]
call fcn.004082bf
mov dword [esp + 0x6b0], 0x5e
test byte [esp + 0x18], 0x10
je 0x415eb6
and dword [esp + 0x18], 0xffffffef
push 1
xor edi, edi
lea esi, [esp + 0x400]
call fcn.00409659
push 8
pop ebx
mov byte [esp + 0x6b0], 0x5f
test byte [esp + 0x18], bl
je 0x415ed9
and dword [esp + 0x18], 0xfffffff7
push 1
xor edi, edi
lea esi, [esp + 0x4c]
call fcn.00409659
xor eax, eax
cmp dword [esp + 0x98], eax
jbe 0x415eff
cmp dword [esp + 0x9c], ebx
jb 0x415ef6
mov edx, dword [esp + 0x88]
jmp 0x415f01
lea edx, [esp + 0x88]
jmp 0x415f01
xor edx, edx
cmp dword [esp + 0xec], eax
jbe 0x415f21
mov eax, dword [esp + 0xdc]
cmp dword [esp + 0xf0], ebx
jae 0x415f21
lea eax, [esp + 0xdc]
mov ecx, dword [esp + 0x2cc]
cmp dword [esp + 0x2e0], ebx
jae 0x415f38
lea ecx, [esp + 0x2cc]
push edx
push eax
lea eax, [esp + 0x43c]
push eax
call fcn.0041382c
push 1
xor edi, edi
lea esi, [esp + 0x8c]
mov byte [esp + 0x6b4], 0x5a
call fcn.00409659
push 1
lea esi, [esp + 0xe0]
mov byte [esp + 0x6b4], 0x55
call fcn.00409659
lea eax, [esp + 0x434]
push eax
mov byte [esp + 0x6b4], 0x4d
call fcn.00413ea3
push 1
xor edi, edi
lea esi, [esp + 0x118]
mov byte [esp + 0x6b4], 0x49
call fcn.00409659
lea eax, [esp + 0xf8]
push eax
lea esi, [esp + 0x118]
call fcn.00408277
lea eax, [esp + 0x18c]
push eax
lea esi, [esp + 0x68]
mov byte [esp + 0x6b4], 0x60
call fcn.00408277
push edi
mov byte [esp + 0x6b4], 0x61
call fcn.004033a7
pop ecx
mov byte [esp + 0x6b0], 0x63
mov dword [esp + 0x1c], edi
cmp dword [esp + 0x74], edi
je 0x416159
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallMagicPlus
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x416159
mov eax, esi
push eax
lea esi, [esp + 0xe0]
call fcn.00408277
mov byte [esp + 0x6b0], 0x64
mov eax, dword [esp + 0xec]
cmp eax, edi
jbe 0x416056
lea ecx, [eax - 1]
mov eax, esi
call fcn.0041a1ec
cmp word [eax], 0x5c
je 0x416056
push 0x585004
mov eax, esi
push eax
call fcn.004082e5
lea eax, [esp + 0x48]
push str.MagicPlus.ico
push eax
lea ebx, [esp + 0xe4]
call fcn.0040ae0a
lea eax, [esp + 0x90]
push str.MagicPlus_Uninstall.exe
push eax
mov byte [esp + 0x6c0], 0x65
call fcn.0040ae0a
mov eax, dword [esp + 0x98]
add esp, 0x10
cmp dword [esp + 0x9c], 8
jae 0x4160a1
lea eax, [esp + 0x88]
mov ecx, dword [esp + 0x98]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add ecx, ecx
push ecx
push eax
push 2
xor edi, edi
push edi
push str.UninstallString
push dword [esp + 0x30]
call esi
cmp dword [esp + 0x5c], 8
mov eax, dword [esp + 0x48]
jae 0x4160d1
lea eax, [esp + 0x48]
mov ecx, dword [esp + 0x58]
add ecx, ecx
push ecx
push eax
xor ebx, ebx
inc ebx
push ebx
push edi
push str.DisplayIcon
push dword [esp + 0x30]
call esi
cmp dword [esp + 0x128], 8
mov eax, dword [esp + 0x114]
jae 0x416101
lea eax, [esp + 0x114]
mov ecx, dword [esp + 0x124]
add ecx, ecx
push ecx
push eax
push ebx
push edi
push str.DisplayName
push dword [esp + 0x30]
call esi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
xor edi, edi
lea esi, [esp + 0x8c]
call fcn.00409659
push ebx
lea esi, [esp + 0x4c]
mov byte [esp + 0x6b4], 0x64
call fcn.00409659
push ebx
lea esi, [esp + 0xe0]
mov byte [esp + 0x6b4], 0x63
call fcn.00409659
xor ebx, ebx
inc ebx
push ebx
xor edi, edi
lea esi, [esp + 0x68]
mov byte [esp + 0x6b4], 0x62
call fcn.00409659
push ebx
lea esi, [esp + 0x118]
mov byte [esp + 0x6b4], 0x49
call fcn.00409659
lea eax, [esp + 0x18c]
push eax
lea esi, [esp + 0xa8]
call fcn.00408277
mov byte [esp + 0x6b0], 0x66
mov eax, dword [esp + 0xb4]
test eax, eax
je 0x4161c9
lea ecx, [eax - 1]
mov eax, esi
call fcn.0041a1ec
cmp word [eax], 0x5c
je 0x4161c9
push 0x585004
mov eax, esi
push eax
call fcn.004082e5
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call edi
lea edx, [esp + 0x30]
lea ecx, [esp + 0x26c]
call fcn.00414433
test eax, eax
je 0x416386
push 0
call fcn.004024ac
pop ecx
push eax
mov ebx, str.027_before_extrac_cab_file_check_failed_will_extract_again
call fcn.0040c7b8
inc dword [esp + 0x28]
sub esp, 0x1c
lea eax, [esp + 0x1e0]
mov esi, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00408277
xor ebx, ebx
push ebx
mov byte [esp + 0x6d0], 0x67
call fcn.00402c67
pop ecx
mov byte [esp + 0x6cc], 0x66
call fcn.00402c96
sub esp, 0x1c
lea eax, [esp + 0x1fc]
mov esi, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00408277
push ebx
mov byte [esp + 0x6d0], 0x68
call fcn.00402c67
pop ecx
mov byte [esp + 0x6cc], 0x66
call fcn.00402c96
push 0x32
call edi
sub esp, 0x1c
lea eax, [esp + 0x1e0]
mov esi, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00408277
sub esp, 0x1c
mov byte [esp + 0x6e8], 0x69
mov esi, esp
mov dword [esp + 0x54], esp
mov edi, 0x5859d8
push edi
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x704], 0x6a
mov esi, esp
mov dword [esp + 0x68], esp
push str.151
call fcn.0040829d
mov byte [esp + 0x704], 0x6b
call fcn.0042ead1
mov esi, dword [eax + 8]
push ebx
call fcn.00402a06
pop ecx
mov ecx, esi
mov byte [esp + 0x704], 0x66
call fcn.00402b7a
sub esp, 0x1c
lea eax, [esp + 0x1fc]
mov esi, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00408277
sub esp, 0x1c
mov byte [esp + 0x6e8], 0x6c
mov esi, esp
mov dword [esp + 0x48], esp
push edi
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x704], 0x6d
mov esi, esp
mov dword [esp + 0x70], esp
push str.209
call fcn.0040829d
mov byte [esp + 0x704], 0x6e
call fcn.0042ead1
mov esi, dword [eax + 8]
push ebx
call fcn.00402a06
pop ecx
mov ecx, esi
mov byte [esp + 0x704], 0x66
call fcn.00402b7a
push 1
xor edi, edi
lea esi, [esp + 0xa8]
mov byte [esp + 0x6b4], 0x49
call fcn.00409659
lea ecx, [esp + 0x26c]
mov byte [esp + 0x6b0], 0x46
call fcn.00405959
cmp dword [esp + 0x28], 3
jl 0x41594c
jmp 0x4163b1
push ebx
xor edi, edi
lea esi, [esp + 0xa8]
mov byte [esp + 0x6b4], 0x49
call fcn.00409659
lea ecx, [esp + 0x26c]
mov byte [esp + 0x6b0], 0x46
call fcn.00405959
mov eax, dword [0x5b9698]
test eax, eax
jne 0x4163ea
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0x6f
test eax, eax
je 0x4163db
mov ebx, eax
call fcn.00404153
jmp 0x4163dd
xor eax, eax
mov byte [esp + 0x6b0], 0x46
mov dword [0x5b9698], eax
push eax
call fcn.00411c04
test eax, eax
je 0x4164d0
sub esp, 0x1c
lea eax, [esp + 0x1a8]
mov esi, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00408277
mov byte [esp + 0x6cc], 0x70
mov eax, dword [0x5b968c]
test eax, eax
jne 0x416451
push 0x90
call fcn.00423341
pop ecx
mov dword [esp + 0x4c], eax
mov byte [esp + 0x6cc], 0x71
test eax, eax
je 0x416442
push eax
call fcn.004032d4
jmp 0x416444
xor eax, eax
mov byte [esp + 0x6cc], 0x70
mov dword [0x5b968c], eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x68], esp
call fcn.0040e8e2
mov byte [esp + 0x6e8], 0x72
mov eax, dword [0x5b968c]
test eax, eax
jne 0x4164a2
push 0x90
call fcn.00423341
pop ecx
mov dword [esp + 0x70], eax
mov byte [esp + 0x6e8], 0x73
test eax, eax
je 0x416493
push eax
call fcn.004032d4
jmp 0x416495
xor eax, eax
mov byte [esp + 0x6e8], 0x72
mov dword [0x5b968c], eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x8c], esp
call fcn.0040e8c9
push 0
mov byte [esp + 0x708], 0x74
call fcn.004033d6
pop ecx
mov byte [esp + 0x704], 0x46
call fcn.0040fb30
mov eax, dword [0x5b9698]
test eax, eax
jne 0x416509
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0x75
test eax, eax
je 0x4164fa
mov ebx, eax
call fcn.00404153
jmp 0x4164fc
xor eax, eax
mov byte [esp + 0x6b0], 0x46
mov dword [0x5b9698], eax
push eax
call fcn.00411c50
test eax, eax
je 0x41652b
push 0
call fcn.004024ac
pop ecx
push eax
mov ebx, str.028_set_apk_file_relation_begin
call fcn.0040c7b8
call fcn.0041163d
mov eax, dword [0x5b9698]
test eax, eax
jne 0x416564
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0x76
test eax, eax
je 0x416555
mov ebx, eax
call fcn.00404153
jmp 0x416557
xor eax, eax
mov byte [esp + 0x6b0], 0x46
mov dword [0x5b9698], eax
push 1
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x34], esp
push str.WriteAutoRunRegistery
mov edi, eax
call fcn.0040829d
mov ecx, edi
call fcn.00411a47
test eax, eax
je 0x416605
push 0
call fcn.004024ac
pop ecx
push eax
mov ebx, str.029_add_auto_run_begin
call fcn.0040c7b8
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.MagicPlus_helper
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x6e8], 0x77
mov esi, esp
mov dword [esp + 0x68], esp
push str.MagicPlus_helper.exe
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x704], 0x78
lea eax, [esp + 0x1e0]
mov esi, esp
mov dword [esp + 0x8c], esp
push eax
call fcn.00408277
push 0
mov byte [esp + 0x708], 0x79
call fcn.004033a7
pop ecx
mov byte [esp + 0x704], 0x46
call fcn.0040eb8d
mov eax, dword [0x5b9698]
test eax, eax
jne 0x41663e
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0x7a
test eax, eax
je 0x41662f
mov ebx, eax
call fcn.00404153
jmp 0x416631
xor eax, eax
mov byte [esp + 0x6b0], 0x46
mov dword [0x5b9698], eax
push eax
call fcn.00411c04
test eax, eax
je 0x416655
push 0
call fcn.004033a7
pop ecx
call fcn.0040ed3a
mov eax, dword [0x5b9698]
test eax, eax
jne 0x41668e
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0x7b
test eax, eax
je 0x41667f
mov ebx, eax
call fcn.00404153
jmp 0x416681
xor eax, eax
mov byte [esp + 0x6b0], 0x46
mov dword [0x5b9698], eax
push eax
call fcn.00411c50
test eax, eax
je 0x416797
mov eax, dword [0x5b968c]
test eax, eax
jne 0x4166d7
push 0x90
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0x7c
test eax, eax
je 0x4166c8
push eax
call fcn.004032d4
jmp 0x4166ca
xor eax, eax
mov byte [esp + 0x6b0], 0x46
mov dword [0x5b968c], eax
movzx edi, word [eax + 0xc]
and edi, 0x800000ff
jns 0x4166eb
dec edi
or edi, 0xffffff00
inc edi
push 0x585164
lea esi, [esp + 0x68]
call fcn.0040829d
mov byte [esp + 0x6b0], 0x7d
cmp edi, 4
jne 0x416713
push 3
pop eax
mov ecx, 0x586cbc
call fcn.00409cec
sub esp, 0x1c
lea eax, [esp + 0x80]
mov esi, esp
mov dword [esp + 0x30], esp
push eax
call fcn.00408277
sub esp, 0x1c
mov byte [esp + 0x6e8], 0x7e
mov esi, esp
mov dword [esp + 0x68], esp
push 0x585148
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x704], 0x7f
lea eax, [esp + 0x1e0]
mov esi, esp
mov dword [esp + 0x8c], esp
push eax
call fcn.00408277
push 0
mov byte [esp + 0x708], 0x80
call fcn.004033a7
pop ecx
mov byte [esp + 0x704], 0x7d
call fcn.0040eeeb
push 1
xor edi, edi
lea esi, [esp + 0x68]
mov byte [esp + 0x6b4], 0x46
call fcn.00409659
mov eax, dword [0x5b9698]
test eax, eax
jne 0x4167d0
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0x81
test eax, eax
je 0x4167c1
mov ebx, eax
call fcn.00404153
jmp 0x4167c3
xor eax, eax
mov byte [esp + 0x6b0], 0x46
mov dword [0x5b9698], eax
push eax
call fcn.00411c76
test eax, eax
je 0x4169f1
push 0
call fcn.004024ac
pop ecx
push eax
mov ebx, str.030_add_icon_below_mycomputer_begin
call fcn.0040c7b8
push 0
call fcn.00402a06
pop ecx
push 0x97
lea eax, [esp + 0x68]
push eax
call fcn.00402a35
lea eax, [esp + 0x18c]
push eax
lea esi, [esp + 0x4c]
mov byte [esp + 0x6b4], 0x82
call fcn.00408277
mov byte [esp + 0x6b0], 0x83
mov eax, dword [esp + 0x58]
cmp eax, 1
jbe 0x416891
lea ecx, [eax - 1]
mov eax, esi
call fcn.0041a1ec
cmp word [eax], 0x5c
je 0x416854
mov ecx, dword [esp + 0x58]
dec ecx
mov eax, esi
call fcn.0041a1ec
cmp word [eax], 0x2f
jne 0x416891
mov eax, dword [esp + 0x58]
dec eax
push eax
push 0
lea eax, [esp + 0x50]
push eax
lea esi, [esp + 0x17c]
call fcn.00408310
mov ebx, eax
lea eax, [esp + 0x48]
mov byte [esp + 0x6b0], 0x84
call fcn.00409383
push 1
xor edi, edi
mov byte [esp + 0x6b4], 0x83
call fcn.00409659
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
mov edi, 0x585d54
push edi
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x6e8], 0x85
mov esi, esp
mov dword [esp + 0x68], esp
push edi
call fcn.0040829d
mov esi, 0x5850ec
lea eax, [esp + 0xdc]
push esi
push eax
lea edi, [esp + 0x88]
mov byte [esp + 0x6f0], 0x86
call fcn.0040ae78
mov ecx, eax
sub esp, 0x14
mov byte [esp + 0x704], 0x87
mov eax, esp
mov dword [esp + 0x8c], esp
push str.MagicPlus.exe__EXECPhone_Icon_Start_Setting
push ecx
call fcn.0040adbd
lea eax, [esp + 0x1cc]
push esi
push eax
mov byte [esp + 0x714], 0x88
call fcn.0040ae78
mov ecx, eax
sub esp, 0xc
mov byte [esp + 0x720], 0x89
mov eax, esp
mov dword [esp + 0xb0], esp
push str.MagicPlus.exe__EXECPhone_Icon_Start
push ecx
call fcn.0040adbd
sub esp, 0x14
mov byte [esp + 0x73c], 0x8a
mov eax, esp
mov dword [esp + 0xd0], esp
push str.MagicPhoneN.ico
push eax
mov ebx, edi
call fcn.0040ae0a
sub esp, 0x14
mov byte [esp + 0x758], 0x8b
mov eax, esp
mov dword [esp + 0xb8], esp
call fcn.00410bf9
sub esp, 0x1c
mov byte [esp + 0x774], 0x8c
lea eax, [esp + 0x128]
mov esi, esp
mov dword [esp + 0xe4], esp
push eax
call fcn.00408277
mov byte [esp + 0x774], 0x8e
call fcn.00410e0d
xor ebx, ebx
inc ebx
push ebx
xor edi, edi
lea esi, [esp + 0x174]
mov byte [esp + 0x6b4], 0x8d
call fcn.00409659
mov byte [esp + 0x6b0], 0x83
push ebx
lea esi, [esp + 0xa8]
call fcn.00409659
push ebx
lea esi, [esp + 0x4c]
mov byte [esp + 0x6b4], 0x82
call fcn.00409659
push ebx
lea esi, [esp + 0x68]
mov byte [esp + 0x6b4], 0x46
call fcn.00409659
mov eax, dword [0x5b9698]
test eax, eax
jne 0x416a2a
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0x8f
test eax, eax
je 0x416a1b
mov ebx, eax
call fcn.00404153
jmp 0x416a1d
xor eax, eax
mov byte [esp + 0x6b0], 0x46
mov dword [0x5b9698], eax
push eax
call fcn.00411c2a
test eax, eax
je 0x416abc
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push str.first.ini
call fcn.0040829d
push 0
mov byte [esp + 0x6d0], 0x90
call fcn.00401edb
pop ecx
lea ecx, [esp + 0x18c]
call fcn.004020c9
mov ecx, eax
sub esp, 0x1c
mov byte [esp + 0x6e8], 0x91
mov eax, esp
mov dword [esp + 0x68], esp
push str.MagicPlus
push ecx
call fcn.0040adbd
push 0
mov byte [esp + 0x6f4], 0x92
call fcn.004033a7
add esp, 0xc
mov byte [esp + 0x6e8], 0x93
call fcn.0040efeb
push 1
xor edi, edi
lea esi, [esp + 0x174]
mov byte [esp + 0x6b4], 0x46
call fcn.00409659
xor edi, edi
push edi
call fcn.004033a7
pop ecx
lea ecx, [esp + 0xc0]
call fcn.0040e95d
mov byte [esp + 0x6b0], 0x94
mov eax, dword [esp + 0xd0]
cmp eax, edi
jbe 0x416b0b
lea ecx, [eax - 1]
lea eax, [esp + 0xc0]
call fcn.0041a1ec
cmp word [eax], 0x5c
je 0x416b0b
push 0x585004
lea eax, [esp + 0xc4]
push eax
call fcn.004082e5
lea eax, [esp + 0x3a0]
push 0x585148
push eax
lea ebx, [esp + 0xc8]
call fcn.0040ae0a
lea eax, [esp + 0x23c]
push str.MagicPlus_helper.exe
push eax
mov byte [esp + 0x6c0], 0x95
call fcn.0040ae0a
lea eax, [esp + 0x1b8]
push str.MobileRes.exe
push eax
mov byte [esp + 0x6c8], 0x96
call fcn.0040ae0a
add esp, 0x18
mov byte [esp + 0x6b0], 0x97
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x32
call esi
cmp dword [esp + 0x248], 8
mov eax, dword [esp + 0x234]
jae 0x416b85
lea eax, [esp + 0x234]
xor ebx, ebx
push ebx
push eax
call fcn.00522f0f
pop ecx
pop ecx
cmp eax, 0xffffffff
jne 0x416bec
mov eax, edi
inc edi
cmp eax, 0xa
jle 0x416b69
call fcn.0041464f
push str.032_findHelperFlag__false
push ebx
call fcn.004024ac
pop ecx
mov ecx, eax
call fcn.0040252f
mov eax, dword [0x5b968c]
cmp eax, ebx
jne 0x4176e1
push 0x90
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0xa0
cmp eax, ebx
je 0x4176d2
push eax
call fcn.004032d4
jmp 0x4176d4
push 0x32
call esi
push ebx
call fcn.004024ac
pop ecx
push eax
mov ebx, str.031_add_short_cut_begin
call fcn.0040c7b8
mov eax, dword [esp + 0x24]
cmp dword [eax + 0x4c4], 0
je 0x416d3a
mov eax, dword [0x5b9698]
test eax, eax
jne 0x416c4c
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0x98
test eax, eax
je 0x416c3d
mov ebx, eax
call fcn.00404153
jmp 0x416c3f
xor eax, eax
mov byte [esp + 0x6b0], 0x97
mov dword [0x5b9698], eax
push 1
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x34], esp
push str.WriteDesktopLink
mov ebx, eax
call fcn.0040829d
mov ecx, ebx
call fcn.00411a47
test eax, eax
je 0x416d3a
cmp dword [esp + 0x10c], 8
mov ebx, dword [esp + 0xf8]
mov edi, ebx
jae 0x416c8e
lea edi, [esp + 0xf8]
mov ebx, edi
cmp dword [esp + 0xd4], 8
mov esi, dword [esp + 0xc0]
jae 0x416ca6
lea esi, [esp + 0xc0]
push 0
call fcn.00402c67
mov dword [esp], str.refdesktopstart
push edi
push 0x585148
push ebx
push 1
mov ecx, esi
call fcn.0040dd3f
cmp dword [esp + 0x1bc], 8
mov eax, dword [esp + 0x1a8]
jae 0x416cdc
lea eax, [esp + 0x1a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x416d3a
cmp dword [esp + 0x168], 8
mov ebx, dword [esp + 0x154]
mov edi, ebx
jae 0x416d04
lea edi, [esp + 0x154]
mov ebx, edi
cmp dword [esp + 0xd4], 8
mov esi, dword [esp + 0xc0]
jae 0x416d1c
lea esi, [esp + 0xc0]
push 0
call fcn.00402c67
mov dword [esp], str.refmrdesktop
push edi
push str.MobileRes.exe
push ebx
push 1
mov ecx, esi
call fcn.0040dd3f
mov eax, dword [0x5b9698]
test eax, eax
jne 0x416d73
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0x99
test eax, eax
je 0x416d64
mov ebx, eax
call fcn.00404153
jmp 0x416d66
xor eax, eax
mov byte [esp + 0x6b0], 0x97
mov dword [0x5b9698], eax
push 1
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x34], esp
push str.WriteStartupMenuLockLink
mov edi, eax
call fcn.0040829d
mov ecx, edi
call fcn.00411a47
test eax, eax
je 0x416e56
cmp dword [esp + 0x10c], 8
mov edi, dword [esp + 0xf8]
jae 0x416db1
lea edi, [esp + 0xf8]
cmp dword [esp + 0xd4], 8
mov ebx, dword [esp + 0xc0]
jae 0x416dc9
lea ebx, [esp + 0xc0]
push 0
call fcn.00402c67
pop ecx
mov esi, str.refstartlockmenu
push esi
push 0x585148
push ebx
push 1
push 0
mov ecx, edi
call fcn.0040d70e
cmp dword [esp + 0x1bc], 8
mov eax, dword [esp + 0x1a8]
jae 0x416e00
lea eax, [esp + 0x1a8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x416e56
cmp dword [esp + 0x168], 8
mov edi, dword [esp + 0x154]
jae 0x416e24
lea edi, [esp + 0x154]
cmp dword [esp + 0xd4], 8
mov ebx, dword [esp + 0xc0]
jae 0x416e3c
lea ebx, [esp + 0xc0]
push 0
call fcn.00402c67
pop ecx
push esi
push str.MobileRes.exe
push ebx
push 1
push 0
mov ecx, edi
call fcn.0040d70e
mov eax, dword [0x5b9698]
test eax, eax
jne 0x416e8f
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0x9a
test eax, eax
je 0x416e80
mov ebx, eax
call fcn.00404153
jmp 0x416e82
xor eax, eax
mov byte [esp + 0x6b0], 0x97
mov dword [0x5b9698], eax
mov ecx, dword [esp + 0x24]
cmp dword [ecx + 0x4c8], 0
je 0x416f99
test eax, eax
jne 0x416ed4
push 0x48
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0x9b
test eax, eax
je 0x416ec5
mov ebx, eax
call fcn.00404153
jmp 0x416ec7
xor eax, eax
mov byte [esp + 0x6b0], 0x97
mov dword [0x5b9698], eax
push 1
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x34], esp
push str.WriteStartupMenuLink
mov ebx, eax
call fcn.0040829d
mov ecx, ebx
call fcn.00411a47
test eax, eax
je 0x416f99
cmp dword [esp + 0x10c], 8
mov ebx, dword [esp + 0xf8]
mov edi, ebx
jae 0x416f16
lea edi, [esp + 0xf8]
mov ebx, edi
cmp dword [esp + 0xd4], 8
mov esi, dword [esp + 0xc0]
jae 0x416f2e
lea esi, [esp + 0xc0]
push 0
call fcn.00402c67
mov dword [esp], str.refstartmenu
push edi
push 0x585148
push ebx
push 0
mov ecx, esi
call fcn.0040dd3f
cmp dword [esp + 0x10c], 8
mov ebx, dword [esp + 0xf8]
jae 0x416f64
lea ebx, [esp + 0xf8]
cmp dword [esp + 0xd4], 8
mov esi, dword [esp + 0xc0]
jae 0x416f7c
lea esi, [esp + 0xc0]
xor edi, edi
push edi
call fcn.00402c67
pop ecx
push edi
push 0x5880d4
push str.MagicPlus_Uninstall.exe
push ebx
push edi
mov ecx, esi
call fcn.0040dd3f
mov eax, dword [0x5b9698]
push 0x48
pop edi
test eax, eax
jne 0x416fd4
push edi
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0x9c
test eax, eax
je 0x416fc5
mov ebx, eax
call fcn.00404153
jmp 0x416fc7
xor eax, eax
mov byte [esp + 0x6b0], 0x97
mov dword [0x5b9698], eax
push eax
call fcn.00411c04
test eax, eax
je 0x417085
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x4e]
push eax
movzx eax, word [esp + 0x4e]
push eax
movzx eax, word [esp + 0x50]
push eax
push str._04d__02d__02d
lea eax, [esp + 0x27c]
push 0x80
push eax
call fcn.0041b4ac
push ecx
lea eax, [esp + 0x288]
mov esi, esp
mov dword [esp + 0x30], esp
push eax
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x6e8], 0x9d
mov esi, esp
mov dword [esp + 0x68], esp
push str.install_time
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x704], 0x9e
mov esi, esp
mov dword [esp + 0x8c], esp
push str.SOFTWAREMagicPlus
call fcn.0040829d
push 0
mov byte [esp + 0x708], 0x9f
call fcn.00402ced
pop ecx
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x704], 0x97
call fcn.00402d1c
mov eax, dword [0x5b9698]
test eax, eax
jne 0x4170bd
push edi
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0xaa
test eax, eax
je 0x4170ae
mov ebx, eax
call fcn.00404153
jmp 0x4170b0
xor eax, eax
mov byte [esp + 0x6b0], 0x97
mov dword [0x5b9698], eax
push 1
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x34], esp
push str.AddToWindowFireWallList
mov ebx, eax
call fcn.0040829d
mov ecx, ebx
call fcn.00411a47
test eax, eax
je 0x4170ff
push 0
call fcn.004024ac
pop ecx
push eax
mov ebx, str.034_add_fire_wall_begin
call fcn.0040c7b8
push 0
call fcn.004033d6
pop ecx
call fcn.0040fd37
mov eax, dword [0x5b9698]
test eax, eax
jne 0x417137
push edi
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0xab
test eax, eax
je 0x417128
mov ebx, eax
call fcn.00404153
jmp 0x41712a
xor eax, eax
mov byte [esp + 0x6b0], 0x97
mov dword [0x5b9698], eax
push eax
call fcn.00411c50
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test eax, eax
je 0x41715b
push str.before_WriteFtpReg
call esi
push 0
call fcn.004033a7
pop ecx
call fcn.0040f092
mov eax, dword [0x5b9698]
test eax, eax
jne 0x417193
push edi
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0xac
test eax, eax
je 0x417184
mov ebx, eax
call fcn.00404153
jmp 0x417186
xor eax, eax
mov byte [esp + 0x6b0], 0x97
mov dword [0x5b9698], eax
push eax
call fcn.00411c2a
test eax, eax
je 0x4171aa
push 0
call fcn.004033d6
pop ecx
call fcn.00410a0c
mov eax, dword [0x5b968c]
test eax, eax
jne 0x4171e5
push 0x90
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0xad
test eax, eax
je 0x4171d6
push eax
call fcn.004032d4
jmp 0x4171d8
xor eax, eax
mov byte [esp + 0x6b0], 0x97
mov dword [0x5b968c], eax
cmp dword [eax + 4], 0
je 0x41723a
mov eax, dword [0x5b9698]
test eax, eax
jne 0x417223
push edi
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0xae
test eax, eax
je 0x417214
mov ebx, eax
call fcn.00404153
jmp 0x417216
xor eax, eax
mov byte [esp + 0x6b0], 0x97
mov dword [0x5b9698], eax
push eax
call fcn.00411c2a
test eax, eax
je 0x41723a
push 0
call fcn.004033d6
pop ecx
call fcn.0040fea2
mov eax, dword [0x5b9698]
test eax, eax
jne 0x417272
push edi
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0xaf
test eax, eax
je 0x417263
mov ebx, eax
call fcn.00404153
jmp 0x417265
xor eax, eax
mov byte [esp + 0x6b0], 0x97
mov dword [0x5b9698], eax
push eax
call fcn.00411aab
mov eax, dword [0x5b9698]
test eax, eax
jne 0x4172b0
push edi
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0xb0
test eax, eax
je 0x4172a1
mov ebx, eax
call fcn.00404153
jmp 0x4172a3
xor eax, eax
mov byte [esp + 0x6b0], 0x97
mov dword [0x5b9698], eax
push eax
call fcn.00411b79
push str.before_WriteLog_success
call esi
xor edi, edi
push edi
push edi
call fcn.004024ac
pop ecx
push eax
call fcn.00402696
mov eax, dword [0x5b968c]
cmp eax, edi
jne 0x417308
push 0x90
call fcn.00423341
pop ecx
mov dword [esp + 0x14], eax
mov byte [esp + 0x6b0], 0xb1
cmp eax, edi
je 0x4172f9
push eax
call fcn.004032d4
jmp 0x4172fb
xor eax, eax
mov byte [esp + 0x6b0], 0x97
mov dword [0x5b968c], eax
cmp dword [eax], edi
je 0x417545
push str.before_SendMessage_WM_USER_APP_INSTALL_SUCCESS
call esi
mov esi, dword [esp + 0x24]
xor edi, edi
push edi
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
push edi
push 0x1c2
push 2
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
push edi
push edi
mov ebx, 0x408
push ebx
push dword [esi + 0x4f4]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
call esi
mov edi, 0xb4
jmp 0x41736e
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x24]
push 0
push 0
push ebx
push dword [eax + 0x4f4]
call esi
cmp eax, edi
jl 0x417355
push 0
call fcn.004024ac
pop ecx
push eax
mov ebx, str.035_add_task_sch_begin
call fcn.0040c7b8
xor esi, esi
mov dword [esp + 0x48], vtable.CDllPromptHelper.0
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], esi
lea ecx, [esp + 0x48]
mov byte [esp + 0x6b0], 0xb2
call fcn.0040f4c2
push esi
call fcn.004024ac
pop ecx
push eax
mov ebx, str.036_add_service_begin
call fcn.0040c7b8
lea eax, [esp + 0xa4]
push str.MagicPlusService.exe
push eax
lea ebx, [esp + 0x194]
call fcn.0040ae0a
pop ecx
pop ecx
mov byte [esp + 0x6b0], 0xb3
cmp dword [esp + 0xb8], 8
mov eax, dword [esp + 0xa4]
jae 0x417405
lea eax, [esp + 0xa4]
xor ebx, ebx
push ebx
push eax
call fcn.00522f0f
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x4174ac
push ebx
push 1
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x38], esp
push str._install
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x6f0], 0xb4
lea eax, [esp + 0xe4]
mov esi, esp
mov dword [esp + 0x70], esp
push eax
call fcn.00408277
sub esp, 0x1c
mov byte [esp + 0x70c], 0xb5
lea eax, [esp + 0x1e8]
mov esi, esp
mov dword [esp + 0x94], esp
push eax
call fcn.00408277
mov byte [esp + 0x70c], 0xb6
cmp dword [0x5b967c], ebx
jne 0x41749f
push 1
call fcn.00423341
pop ecx
mov ecx, eax
cmp ecx, ebx
je 0x417499
xor eax, eax
mov edi, ecx
stosb byte es:[edi], al
mov dword [0x5b967c], ecx
jmp 0x41749f
mov dword [0x5b967c], ebx
mov byte [esp + 0x70c], 0xb3
call fcn.0040cb9a
push 1
xor edi, edi
lea esi, [esp + 0xa8]
mov byte [esp + 0x6b4], 0xb2
call fcn.00409659
lea ecx, [esp + 0x48]
mov byte [esp + 0x6b0], 0x97
call fcn.0040f4a5
mov esi, dword [esp + 0x24]
push ebx
push ebx
push 0x408
push dword [esi + 0x4f4]
mov dword [esi + 0xc4], ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
call ebx
mov edi, 0x12c
jmp 0x417514
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 0x408
push dword [esi + 0x4f4]
call ebx
cmp eax, edi
jl 0x4174fb
xor edi, edi
push edi
lea ecx, [esi + 0x4d4]
call fcn.0042a151
push edi
push 0x32
push 3
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
push edi
lea ecx, [esi + 0x608]
call fcn.0042a151
jmp 0x4176c1
push edi
call fcn.004024ac
pop ecx
push eax
mov ebx, str.037_add_task_sch__else__begin
call fcn.0040c7b8
xor esi, esi
mov dword [esp + 0x48], vtable.CDllPromptHelper.0
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], esi
lea ecx, [esp + 0x48]
mov byte [esp + 0x6b0], 0xb7
call fcn.0040f4c2
push esi
call fcn.004024ac
pop ecx
push eax
mov ebx, str.038_add_service_begin
call fcn.0040c7b8
lea eax, [esp + 0xa4]
push str.MagicPlusService.exe
push eax
lea ebx, [esp + 0x194]
call fcn.0040ae0a
pop ecx
pop ecx
mov byte [esp + 0x6b0], 0xb8
cmp dword [esp + 0xb8], 8
mov eax, dword [esp + 0xa4]
jae 0x4175d7
lea eax, [esp + 0xa4]
xor ebx, ebx
push ebx
push eax
call fcn.00522f0f
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x41767e
push ebx
push 1
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x38], esp
push str._install
call fcn.0040829d
sub esp, 0x1c
mov byte [esp + 0x6f0], 0xb9
lea eax, [esp + 0xe4]
mov esi, esp
mov dword [esp + 0x70], esp
push eax
call fcn.00408277
sub esp, 0x1c
mov byte [esp + 0x70c], 0xba
lea eax, [esp + 0x1e8]
mov esi, esp
mov dword [esp + 0x94], esp
push eax
call fcn.00408277
mov byte [esp + 0x70c], 0xbb
cmp dword [0x5b967c], ebx
jne 0x417671
push 1
call fcn.00423341
pop ecx
mov ecx, eax
cmp ecx, ebx
je 0x41766b
xor eax, eax
mov edi, ecx
stosb byte es:[edi], al
mov dword [0x5b967c], ecx
jmp 0x417671
mov dword [0x5b967c], ebx
mov byte [esp + 0x70c], 0xb8
call fcn.0040cb9a
push 1
xor edi, edi
lea esi, [esp + 0xa8]
mov byte [esp + 0x6b4], 0xb7
call fcn.00409659
lea ecx, [esp + 0x48]
mov byte [esp + 0x6b0], 0x97
call fcn.0040f4a5
mov eax, dword [esp + 0x24]
push ebx
push ebx
push 0x4d4
push dword [eax + 0x20]
mov dword [eax + 0xc4], ebx
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
call fcn.004024ac
mov ebx, str.039_install_thread_end____ok
jmp 0x417cdf
xor eax, eax
mov byte [esp + 0x6b0], 0x97
mov dword [0x5b968c], eax
cmp dword [eax], ebx
jne 0x417c52
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, 0x585d54
push edi
lea esi, [esp + 0x118]
mov ebx, eax
call fcn.0040829d
and dword [esp + 0x24], 0
lea eax, [esp + 0x24]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
and dword [esp + 0x58], 0
mov ebx, eax
xor eax, eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x5c], 7
mov word [esp + 0x48], ax
push str._dbgrestart
lea esi, [esp + 0xe0]
mov byte [esp + 0x6b4], 0xa2
call fcn.0040829d
mov byte [esp + 0x6b0], 0xa3
and dword [esp + 0x28], 0
push edi
lea esi, [esp + 0x8c]
call fcn.0040829d
mov byte [esp + 0x6b0], 0xa4
cmp dword [esp + 0x24], 0
jle 0x417794
mov ebx, dword [ebx]
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x417777
sub eax, edx
sar eax, 1
mov ecx, ebx
lea esi, [esp + 0x88]
call fcn.00409cec
xor ebx, ebx
inc ebx
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x24], ebx
jle 0x417af2
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x34]
lea eax, [eax + ecx*4]
mov ecx, dword [eax]
mov dword [esp + 0x20], eax
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
add eax, 2
test si, si
jne 0x4177bb
sub eax, edx
sar eax, 1
lea esi, [esp + 0x48]
call fcn.00409cec
push ebx
push 0x5857a0
xor eax, eax
mov ecx, esi
call fcn.00409531
cmp eax, 0xffffffff
je 0x417858
mov esi, 0x5850ec
lea eax, [esp + 0x64]
push esi
push eax
lea edi, [esp + 0x50]
call fcn.0040ae78
push esi
push eax
lea eax, [esp + 0x180]
mov byte [esp + 0x6c0], 0xa5
call fcn.0040adbd
add esp, 0x10
mov ebx, eax
mov eax, edi
mov byte [esp + 0x6b0], 0xa6
call fcn.00409383
push 1
xor edi, edi
lea esi, [esp + 0x174]
mov byte [esp + 0x6b4], 0xa5
call fcn.00409659
push 1
lea esi, [esp + 0x68]
mov byte [esp + 0x6b4], 0xa4
call fcn.00409659
xor ebx, ebx
inc ebx
jmp 0x41794a
mov eax, dword [esp + 0xec]
cmp dword [esp + 0x58], eax
jb 0x4178b7
push eax
push 0
lea eax, [esp + 0x50]
push eax
lea esi, [esp + 0x17c]
call fcn.00408310
mov ecx, eax
mov byte [esp + 0x6b0], 0xa7
or dword [esp + 0x18], ebx
cmp dword [esp + 0xf0], 8
mov eax, dword [esp + 0xdc]
jae 0x41789f
lea eax, [esp + 0xdc]
mov edi, dword [esp + 0xec]
push eax
mov eax, dword [ecx + 0x10]
call fcn.0040b61c
mov byte [esp + 0x2f], bl
test eax, eax
je 0x4178bc
mov byte [esp + 0x2f], 0
mov dword [esp + 0x6b0], 0xa4
test byte [esp + 0x18], bl
je 0x4178e1
and dword [esp + 0x18], 0xfffffffe
push ebx
xor edi, edi
lea esi, [esp + 0x174]
call fcn.00409659
cmp byte [esp + 0x2f], 0
je 0x417925
push 0xffffffffffffffff
push dword [esp + 0xf0]
lea eax, [esp + 0x50]
push eax
lea esi, [esp + 0x70]
call fcn.00408310
cmp dword [esp + 0x78], 8
mov eax, dword [esp + 0x64]
jae 0x41790c
mov eax, esi
push eax
call fcn.005239a8
pop ecx
push ebx
xor edi, edi
lea esi, [esp + 0x68]
mov dword [esp + 0x2c], eax
call fcn.00409659
jmp 0x41794a
mov eax, dword [esp + 0x20]
push dword [eax]
lea eax, [esp + 0x118]
push eax
call fcn.004082e5
push 0x5857a0
lea eax, [esp + 0x118]
push eax
call fcn.004082e5
inc dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x24]
jl 0x4177a5
cmp dword [esp + 0x28], 3
jle 0x417af2
push ebx
xor edi, edi
lea esi, [esp + 0x8c]
mov byte [esp + 0x6b4], 0xa3
call fcn.00409659
push ebx
lea esi, [esp + 0xe0]
mov byte [esp + 0x6b4], 0xa2
call fcn.00409659
push ebx
lea esi, [esp + 0x4c]
mov byte [esp + 0x6b4], 0xa1
call fcn.00409659
push ebx
lea esi, [esp + 0x118]
mov byte [esp + 0x6b4], 0x97
call fcn.00409659
push ebx
lea esi, [esp + 0x1ac]
mov byte [esp + 0x6b4], 0x96
call fcn.00409659
push ebx
lea esi, [esp + 0x238]
mov byte [esp + 0x6b4], 0x95
call fcn.00409659
push ebx
lea esi, [esp + 0x3a4]
mov byte [esp + 0x6b4], 0x94
call fcn.00409659
push ebx
lea esi, [esp + 0xc4]
mov byte [esp + 0x6b4], 0x46
call fcn.00409659
push edi
push ebx
lea ecx, [esp + 0x38c]
mov byte [esp + 0x6b8], 0x43
call fcn.0040933f
push ebx
lea esi, [esp + 0x190]
mov byte [esp + 0x6b4], 0x3b
call fcn.00409659
push ebx
lea esi, [esp + 0x1e4]
mov byte [esp + 0x6b4], 0x3a
call fcn.00409659
push ebx
lea esi, [esp + 0x1c8]
mov byte [esp + 0x6b4], 0x39
call fcn.00409659
push ebx
lea esi, [esp + 0x254]
mov byte [esp + 0x6b4], 0x38
call fcn.00409659
push ebx
lea esi, [esp + 0xfc]
mov byte [esp + 0x6b4], 0x1c
call fcn.00409659
push ebx
lea esi, [esp + 0x158]
mov byte [esp + 0x6b4], 9
call fcn.00409659
push ebx
lea esi, [esp + 0x13c]
mov byte [esp + 0x6b4], 8
call fcn.00409659
push ebx
lea esi, [esp + 0x21c]
mov byte [esp + 0x6b4], bl
call fcn.00409659
push edi
push ebx
lea ecx, [esp + 0x204]
mov byte [esp + 0x6b8], 0
call fcn.0040933f
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x417aeb
and dword [eax], edi
mov eax, ebx
jmp 0x417e1e
mov eax, dword [esp + 0x28]
inc eax
push eax
push 0x5857a4
lea eax, [esp + 0x43c]
push 0x100
push eax
call fcn.0041b4ac
add esp, 0x10
lea eax, [esp + 0x434]
push eax
lea eax, [esp + 0x118]
push eax
call fcn.004082e5
lea eax, [esp + 0x64]
push 0x5857a0
push eax
lea ebx, [esp + 0x90]
call fcn.0040ae0a
lea ecx, [esp + 0x11c]
push ecx
lea ecx, [esp + 0x3c8]
push ecx
mov ecx, eax
mov byte [esp + 0x6c0], 0xa8
call fcn.0040ade1
push 0x5857c4
push eax
lea eax, [esp + 0x188]
mov byte [esp + 0x6c8], 0xa9
call fcn.0040adbd
add esp, 0x18
cmp dword [eax + 0x14], 8
jb 0x417b81
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor ebx, ebx
inc ebx
push ebx
xor edi, edi
lea esi, [esp + 0x174]
call fcn.00409659
push ebx
lea esi, [esp + 0x3c0]
mov byte [esp + 0x6b4], 0xa8
call fcn.00409659
push ebx
lea esi, [esp + 0x68]
mov byte [esp + 0x6b4], 0xa4
call fcn.00409659
mov esi, 0x114
push esi
lea eax, [esp + 0x270]
push edi
push eax
call fcn.00527ca0
add esp, 0xc
lea eax, [esp + 0x26c]
push eax
mov dword [esp + 0x270], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x270], 5
jb 0x417c02
jne 0x417c09
cmp dword [esp + 0x274], ebx
ja 0x417c09
mov edx, str.Open
jmp 0x417c0e
mov edx, 0x5850f0
cmp dword [esp + 0x128], 8
mov ecx, dword [esp + 0x114]
jae 0x417c26
lea ecx, [esp + 0x114]
cmp dword [esp + 0x9c], 8
mov eax, dword [esp + 0x88]
jae 0x417c3e
lea eax, [esp + 0x88]
push ebx
push edi
push ecx
push eax
push edx
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov edi, dword [esp + 0x24]
mov esi, dword [sym.imp.USER32.dll_KillTimer]
xor ebx, ebx
push ebx
push dword [edi + 0x20]
mov dword [edi + 0xc4], ebx
call esi
push 1
push dword [edi + 0x20]
call esi
push 2
push dword [edi + 0x20]
call esi
push 3
push dword [edi + 0x20]
call esi
call fcn.0041464f
push ebx
lea ecx, [edi + 0x4d4]
call fcn.0042a151
push ebx
lea ecx, [edi + 0x608]
call fcn.0042a151
push 1
lea ecx, [edi + 0x15c]
call fcn.0042a193
push 5
lea ecx, [edi + 0x57c]
call fcn.0042a151
push ebx
lea ecx, [edi + 0x734]
call fcn.0042a151
push 1
push ebx
push dword [edi + 0x20]
mov dword [edi + 0x4d0], ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
push ebx
call fcn.004024ac
mov ebx, str.033_install_failed
pop ecx
push eax
call fcn.0040c7b8
xor ebx, ebx
inc ebx
push ebx
xor edi, edi
lea esi, [esp + 0x1ac]
mov byte [esp + 0x6b4], 0x96
call fcn.00409659
push ebx
lea esi, [esp + 0x238]
mov byte [esp + 0x6b4], 0x95
call fcn.00409659
push ebx
lea esi, [esp + 0x3a4]
mov byte [esp + 0x6b4], 0x94
call fcn.00409659
push ebx
lea esi, [esp + 0xc4]
mov byte [esp + 0x6b4], 0x46
call fcn.00409659
push edi
push ebx
lea ecx, [esp + 0x38c]
mov byte [esp + 0x6b8], 0x43
call fcn.0040933f
push ebx
lea esi, [esp + 0x190]
mov byte [esp + 0x6b4], 0x3b
call fcn.00409659
push ebx
lea esi, [esp + 0x1e4]
mov byte [esp + 0x6b4], 0x3a
call fcn.00409659
push ebx
lea esi, [esp + 0x1c8]
mov byte [esp + 0x6b4], 0x39
call fcn.00409659
push ebx
lea esi, [esp + 0x254]
mov byte [esp + 0x6b4], 0x38
call fcn.00409659
push ebx
lea esi, [esp + 0xfc]
mov byte [esp + 0x6b4], 0x1c
call fcn.00409659
push ebx
lea esi, [esp + 0x158]
mov byte [esp + 0x6b4], 9
call fcn.00409659
push ebx
lea esi, [esp + 0x13c]
mov byte [esp + 0x6b4], 8
call fcn.00409659
push ebx
lea esi, [esp + 0x21c]
mov byte [esp + 0x6b4], bl
call fcn.00409659
push edi
push ebx
lea ecx, [esp + 0x204]
mov byte [esp + 0x6b8], 0
call fcn.0040933f
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x417e1c
and dword [eax], edi
xor eax, eax
mov ecx, dword [esp + 0x6a8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x690]
xor ecx, esp
call fcn.005220b2
mov esp, ebp
pop ebp
ret 4