Function at 0x4015e7
Capabilities:
Create directory
Delete directory
Enumerate gui resources
Identify system language via api
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x760
mov eax, dword [ebp + 8]
push str._DDE0BB24_8F8C_44e9_B962_8289B302DEF9
push 0x40d26c
mov dword [0x40d5a4], eax
call fcn.004031e4
pop ecx
test eax, eax
pop ecx
je 0x401614
xor eax, eax
jmp 0x4023e1
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor ebx, ebx
and eax, 0x3ff
push ebx
push 0x4026e0
mov dword [ebp - 0x38], eax
call dword [sym.imp.USER32.dll_EnumWindows]
mov edi, dword [ebp + 0x10]
push 0x40d268
push edi
call fcn.004031e4
mov esi, eax
push 0x40d264
neg esi
sbb esi, esi
push edi
neg esi
mov dword [ebp - 0xc], esi
call fcn.004031e4
add esp, 0x10
neg eax
sbb eax, eax
neg eax
cmp esi, ebx
mov dword [0x40d5a0], eax
jne 0x401680
push 0x40d260
push edi
call fcn.004031e4
neg eax
sbb eax, eax
pop ecx
inc eax
pop ecx
mov dword [0x40d5a0], eax
push str._ieto
push edi
call fcn.004031e4
pop ecx
test eax, eax
pop ecx
je 0x4016a7
push str.f4a1d92b_91f3_4e71_9227_a27e641f9d81
call fcn.0040122e
test eax, eax
pop ecx
mov dword [ebp - 0x24], 1
je 0x4016aa
mov dword [ebp - 0x24], ebx
push str._ffto
push edi
call fcn.004031e4
pop ecx
test eax, eax
pop ecx
je 0x4016d1
push str.87011c4e_fcde_4476_9348_ecf16134fc1f
call fcn.0040122e
test eax, eax
pop ecx
mov dword [ebp - 0x20], 1
je 0x4016d4
mov dword [ebp - 0x20], ebx
call fcn.004011ce
cmp esi, ebx
mov dword [ebp - 0x18], eax
mov edi, 0x40416c
jne 0x401732
cmp eax, ebx
push 1
jne 0x401700
push 0x40d5ac
push str.PartnerPixelNotSet
push edi
call fcn.0040397a
add esp, 0x10
jmp 0x401712
push str.Visible
push edi
call fcn.004036b7
add esp, 0xc
test eax, eax
jne 0x401722
push 1
push str.Maximized
push edi
call fcn.004036f8
add esp, 0xc
push 1
push str.Visible
push edi
call fcn.004036f8
add esp, 0xc
cmp esi, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x1c], ebx
jne 0x40178a
push 0x40d1e8
push dword [ebp + 0x10]
call fcn.004031e4
pop ecx
test eax, eax
pop ecx
je 0x40178a
cmp dword [ebp - 0x18], ebx
push 1
pop edi
mov dword [ebp - 0x1c], edi
jne 0x40175d
mov dword [ebp - 8], edi
call fcn.00401565
mov esi, eax
push str.87011c4e_fcde_4476_9348_ecf16134fc1f
neg esi
sbb esi, esi
inc esi
mov dword [ebp - 0x24], esi
call fcn.0040122e
neg eax
sbb eax, eax
pop ecx
inc eax
cmp esi, ebx
mov dword [ebp - 0x20], eax
je 0x40178a
cmp eax, ebx
je 0x40178a
mov dword [ebp - 8], edi
push 0x34
mov esi, str._pAFWman000YYA__tc0x33050__hwlHPWL_DDE0BB24_8F8C_44e9_B962_8289B302DEF90000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
pop ecx
lea edi, [ebp - 0x378]
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0xc], ebx
movsb byte es:[edi], byte [esi]
jne 0x401984
cmp dword [ebp - 0x18], ebx
jne 0x401955
mov esi, 0x40d110
push esi
push dword [ebp + 0x10]
call fcn.004031e4
pop ecx
cmp eax, ebx
pop ecx
jne 0x4017e4
cmp byte [ebp - 0x378], bl
je 0x401864
lea eax, [ebp - 0x378]
push esi
push eax
call fcn.004031e4
pop ecx
cmp eax, ebx
pop ecx
je 0x401864
push 0x3d
push eax
call fcn.00403144
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x401864
movsx eax, byte [esi + 1]
xor edi, edi
inc esi
push eax
call fcn.0040328d
test eax, eax
pop ecx
jne 0x40182a
mov al, byte [edi + esi]
cmp al, 0x2f
je 0x401822
cmp al, bl
je 0x401822
movsx eax, byte [edi + esi + 1]
inc edi
push eax
call fcn.0040328d
test eax, eax
pop ecx
je 0x401806
cmp edi, 0xc8
jae 0x401864
inc edi
lea eax, [ebp - 0x268]
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
push ebx
mov esi, 0x40416c
push str.pid2
push esi
call fcn.0040397a
lea eax, [ebp - 0x268]
push ebx
push eax
push 0x40cd30
push esi
call fcn.0040397a
add esp, 0x20
jmp 0x401869
mov esi, 0x40416c
mov dword [ebp - 0x14], str._psid
mov dword [ebp - 0x10], str._ic
mov dword [ebp - 0x2c], str.psid
mov dword [ebp - 0x28], 0x40d0ec
mov dword [ebp + 8], ebx
jmp 0x40188f
mov esi, 0x40416c
mov eax, dword [ebp + 8]
push dword [ebp + eax - 0x14]
push dword [ebp + 0x10]
call fcn.004031e4
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x401916
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
push dword [ebp + eax - 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add edi, eax
movsx eax, byte [edi]
push eax
call fcn.0040328d
test eax, eax
pop ecx
jne 0x4018f2
mov eax, dword [ebp - 4]
mov al, byte [eax + edi]
cmp al, 0x2f
je 0x4018e9
cmp al, bl
je 0x4018e9
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
movsx eax, byte [eax + edi]
push eax
call fcn.0040328d
test eax, eax
pop ecx
je 0x4018c6
cmp dword [ebp - 4], 0xc8
jae 0x401947
mov eax, dword [ebp - 4]
inc eax
push eax
lea eax, [ebp - 0x268]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x268]
push ebx
push eax
mov eax, dword [ebp + 8]
push dword [ebp + eax - 0x2c]
jmp 0x40193e
mov eax, dword [ebp + 8]
cmp eax, ebx
jle 0x401947
mov edi, dword [ebp + eax - 0x2c]
lea eax, [ebp - 0x268]
push 0xc8
push eax
push edi
push esi
call fcn.00403788
add esp, 0x10
test eax, eax
je 0x401947
push ebx
push ebx
push edi
push esi
call fcn.0040397a
add esp, 0x10
add dword [ebp + 8], 4
cmp dword [ebp + 8], 8
jb 0x40188a
cmp dword [ebp - 8], ebx
jne 0x401984
mov esi, str.CV_DDE0BB24_8F8C_44e9_B962_8289B302DEF9
push str._DDE0BB24_8F8C_44e9_B962_8289B302DEF9
push esi
call fcn.004031e4
pop ecx
test eax, eax
pop ecx
jne 0x401984
push ebx
push esi
push 0x40d0e8
push 0x40416c
call fcn.0040397a
add esp, 0x10
push ebx
mov esi, 0x40d0e4
push ebx
mov edi, 0x40416c
push esi
push edi
call fcn.0040397a
add esp, 0x10
cmp dword [ebp - 0xc], ebx
jne 0x401c34
cmp dword [ebp - 8], ebx
jne 0x4019b8
push ebx
push str.PackageTracer
push esi
push edi
call fcn.0040397a
add esp, 0x10
mov esi, str._tc
push esi
push dword [ebp + 0x10]
call fcn.004031e4
pop ecx
cmp eax, ebx
pop ecx
jne 0x4019ef
cmp byte [ebp - 0x378], bl
je 0x401a8a
lea eax, [ebp - 0x378]
push esi
push eax
call fcn.004031e4
pop ecx
cmp eax, ebx
pop ecx
je 0x401a8a
add eax, 4
push eax
call fcn.004032c6
cmp eax, ebx
pop ecx
mov dword [ebp + 8], eax
je 0x401a8a
mov edi, str.tiec
push eax
mov esi, 0x40416c
push edi
push esi
call fcn.004036f8
push 3
push dword [ebp + 8]
push edi
push esi
call fcn.00403726
mov eax, dword [ebp + 8]
mov esi, str.SoftwarePackageTracer_69_barSwitches
shr eax, 0x10
and eax, 1
mov edi, SysStringLen
push eax
push 0x40d098
push esi
push edi
call fcn.00403757
mov eax, dword [ebp + 8]
shr eax, 0x11
and eax, 1
push eax
push 0x40d094
push esi
push edi
call fcn.00403757
mov eax, dword [ebp + 8]
shr eax, 9
and eax, 1
push eax
push 0x40d090
push esi
push edi
call fcn.00403757
mov eax, dword [ebp + 8]
add esp, 0x4c
shr eax, 0xf
and eax, 1
push eax
push 0x40d08c
push esi
push edi
call fcn.00403757
add esp, 0x10
cmp dword [ebp - 8], ebx
jne 0x401c34
cmp dword [ebp - 0x18], ebx
jne 0x401b79
push str._idate
push dword [ebp + 0x10]
call fcn.004031e4
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp + 8], eax
je 0x401b25
mov esi, str.0123456789:_TZtz
lea edi, [ebp - 0x19c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add dword [ebp + 8], 7
push 0x15
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x188]
push ebx
push eax
movsb byte es:[edi], byte [esi]
call fcn.00403395
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x188]
add esp, 0xc
mov dword [ebp - 0x10], ebx
sub edi, esi
movsx eax, byte [esi]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.00403144
pop ecx
test eax, eax
pop ecx
je 0x401b0b
mov al, byte [esi]
inc dword [ebp - 0x10]
mov byte [edi + esi], al
inc esi
cmp dword [ebp - 0x10], 0x14
jl 0x401ae6
lea eax, [ebp - 0x188]
push ebx
push eax
push str.idate
push 0x40416c
call fcn.0040397a
add esp, 0x10
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [ebp - 0x28]
push eax
movzx eax, word [ebp - 0x2a]
push eax
movzx eax, word [ebp - 0x2c]
push eax
movzx eax, word [ebp - 0x2e]
push eax
movzx eax, word [ebp - 0x32]
push eax
movzx eax, word [ebp - 0x34]
push eax
lea eax, [ebp - 0x1e0]
push str._04d__02d__02dT_02d:_02d:_02dZ
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x1e0]
push ebx
push eax
push str.lidate
push 0x40416c
call fcn.0040397a
add esp, 0x30
mov esi, str._hwl
push esi
push dword [ebp + 0x10]
call fcn.004031e4
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
jne 0x401bc4
lea eax, [ebp - 0x378]
push esi
push eax
call fcn.004031e4
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x401bbb
lea eax, [ebp - 0x378]
push str._hwlHPWL_DDE0BB24_8F8C_44e9_B962_8289B302DEF9
push eax
call fcn.004031e4
pop ecx
test eax, eax
pop ecx
je 0x401bc0
mov edi, str._hwl.mywebsearch.com_.google.com_.yahoo.com_.bing.com_.msn.com
cmp edi, ebx
je 0x401c34
push 0x3d
push edi
call fcn.00403144
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x401c34
movsx eax, byte [edi + 1]
xor esi, esi
inc edi
push eax
call fcn.0040328d
test eax, eax
pop ecx
jne 0x401c0a
mov al, byte [esi + edi]
cmp al, 0x2f
je 0x401c02
cmp al, bl
je 0x401c02
movsx eax, byte [esi + edi + 1]
inc esi
push eax
call fcn.0040328d
test eax, eax
pop ecx
je 0x401be6
cmp esi, 0x3e8
jae 0x401c34
inc esi
lea eax, [ebp - 0x760]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x760]
push ebx
push eax
push str.hpwl
push 0x40416c
call fcn.0040397a
add esp, 0x10
mov al, byte [0x40d5ac]
push 0x4a
mov byte [ebp - 0x170], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x16f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0xc]
push ebx
neg eax
sbb eax, eax
mov esi, 0x40416c
and eax, 2
lea edi, [ebp - 0x3c]
mov dword [ebp - 0x44], eax
xor eax, eax
push str.CurInstall
mov dword [ebp - 0x40], ebx
push esi
stosd dword es:[edi], eax
call fcn.004036b7
add esp, 0xc
cmp dword [ebp - 0xc], ebx
mov dword [ebp + 8], eax
jne 0x401c89
cmp dword [ebp - 8], ebx
jne 0x401c89
inc dword [ebp + 8]
push ebx
lea eax, [ebp - 0x170]
push 0xfa
push eax
push ebx
push ebx
push 0x404198
push esi
call fcn.00403b15
add esp, 0x1c
test eax, eax
je 0x402346
cmp byte [ebp - 0x170], bl
je 0x402346
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [ebp + 8]
mov edi, str._x.bin_
lea eax, [ebp + eax - 0x170]
push edi
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
cmp dword [ebp - 0xc], ebx
jne 0x401d5d
cmp dword [ebp - 8], ebx
jne 0x401d5d
lea eax, [ebp - 0x170]
push ebx
push eax
call esi
test eax, eax
jne 0x401d5d
mov eax, dword [ebp + 8]
lea ecx, [eax + 5]
cmp eax, ecx
jge 0x401d5d
inc eax
mov dword [ebp - 0x10], eax
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x170]
push ebx
push eax
call esi
test eax, eax
jne 0x401d3f
mov eax, dword [ebp + 8]
add eax, 5
cmp dword [ebp - 0x10], eax
jg 0x401d45
inc dword [ebp - 0x10]
push dword [ebp - 0x10]
jmp 0x401d11
mov eax, dword [ebp - 0x10]
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp + 8], eax
je 0x401d5d
push dword [ebp + 8]
push edi
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x402346
cmp dword [ebp - 8], ebx
mov edi, dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
mov esi, 0x4023e6
jne 0x401e59
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x170]
push eax
push esi
push str.PREPART
push dword [0x40d5a4]
call edi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40434c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x401d86
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x170]
push str.assists_
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x170]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x170]
push str.ie_default_search_provider_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x170]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x170]
push eax
push esi
push str.ASSIST
push dword [0x40d5a4]
call edi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40434c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x401e22
mov eax, dword [ebp - 0x10]
mov byte [eax], bl
cmp dword [ebp - 0x40], ebx
jne 0x40226f
cmp dword [ebp - 0x20], ebx
mov dword [ebp - 0x3c], ebx
jne 0x4020a7
cmp dword [ebp - 0x24], ebx
je 0x401e7f
mov dword [ebp - 0x3c], str.69ffxtbr.jar
cmp dword [ebp - 0x3c], ebx
jne 0x401e8b
cmp dword [ebp - 0x1c], ebx
je 0x401e8b
mov dword [ebp - 0x3c], str.69ffxtbr.jar
xor eax, eax
cmp dword [ebp - 0xc], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
sete al
cmp dword [ebp - 8], ebx
mov dword [0x40d5a8], eax
jne 0x401ed5
lea eax, [ebp - 0x170]
push eax
push esi
push str.PART
push dword [0x40d5a4]
call edi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40434c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x401ea3
cmp dword [ebp - 0x40], ebx
mov dword [0x40d5a8], ebx
jne 0x40226f
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 8], ebx
jne 0x402201
cmp dword [ebp - 0xc], ebx
jne 0x402204
call fcn.0040159b
cmp dword [ebp - 0x18], ebx
jne 0x401f3b
push ebx
push ebx
push str.ConfigDateStamp
push 0x40416c
call fcn.0040397a
push 3
push ebx
push ebx
push str.ConfigDateStamp
push 0x40416c
call fcn.00403995
add esp, 0x24
push dword [ebp + 8]
push str.CurInstall
push 0x40416c
call fcn.004036f8
add esp, 0xc
dec dword [ebp + 8]
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x170]
push str.chrome_
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x170]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x170]
push eax
push esi
push str.CHROME
push dword [0x40d5a4]
call edi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40434c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x401f90
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x1c], ebx
mov byte [eax], bl
jne 0x4020ec
lea eax, [ebp - 0x170]
push str.69Plugin
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x170]
push str..DLL
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 8
lea eax, [ebp - 0x170]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
cmp eax, ebx
mov dword [ebp - 0x20], eax
je 0x4020e7
push str.UUEX
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x4020de
push str._fsa
push dword [ebp + 0x10]
call fcn.004031e4
pop ecx
test eax, eax
pop ecx
jne 0x40204f
push 0x40cf64
push dword [ebp + 0x10]
call fcn.004031e4
pop ecx
mov dword [ebp - 0x1c], ebx
test eax, eax
pop ecx
je 0x402056
mov dword [ebp - 0x1c], 1
push str._ffhp
push dword [ebp + 0x10]
call fcn.004031e4
pop ecx
test eax, eax
pop ecx
jne 0x4020b3
push str._fhp
push dword [ebp + 0x10]
call fcn.004031e4
pop ecx
test eax, eax
pop ecx
jne 0x4020b3
push 0x40cf50
push dword [ebp + 0x10]
call fcn.004031e4
pop ecx
test eax, eax
pop ecx
je 0x4020a2
push str._ffto
push dword [ebp + 0x10]
call fcn.004031e4
pop ecx
test eax, eax
pop ecx
jne 0x4020b3
mov dword [ebp - 0x24], ebx
jmp 0x4020ba
mov dword [ebp - 0x3c], str.69REGIET.DLL
jmp 0x401e7a
mov dword [ebp - 0x24], 1
push str._ftab
push dword [ebp + 0x10]
call fcn.004031e4
pop ecx
pop ecx
push dword [ebp - 0x1c]
neg eax
push dword [ebp - 0x1c]
sbb eax, eax
push dword [ebp - 0x24]
neg eax
push eax
push ebx
push ebx
call dword [ebp - 0x10]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x18]
mov byte [eax], bl
push str.Message_
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x170]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x170]
push eax
push esi
push str.MESSAGE
push dword [0x40d5a4]
call edi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40434c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x40210e
push str.gen1_
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x170]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x170]
push eax
push esi
push str.GEN1
push dword [0x40d5a4]
call edi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40434c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x402162
push str.IE9Mesg_
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x170]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x170]
push eax
push esi
push str.IE9MESG
push dword [0x40d5a4]
call edi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40434c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x4021b6
call fcn.004013ad
call fcn.004010c2
lea eax, [ebp - 0x2a4]
push eax
call fcn.004010e7
pop ecx
jmp 0x402204
dec dword [ebp + 8]
cmp dword [ebp + 8], ebx
jle 0x402267
push dword [ebp + 8]
push str._x.bin_
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x402201
lea eax, [ebp - 0x170]
mov dword [ebp - 0x40], ebx
push eax
push esi
push str.PART
mov dword [ebp - 0x44], 3
push dword [0x40d5a4]
call edi
push 0x40cf0c
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x402201
mov dword [ebp - 0x40], ebx
jmp 0x402340
mov eax, dword [ebp - 0x40]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x170]
push str.assists_
mov dword [ebp + 0x10], eax
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x170]
push str.ie_default_search_provider_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], 2
lea eax, [ebp - 0x170]
push eax
push esi
push str.ASSIST
push dword [0x40d5a4]
call edi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40434c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x4022c7
mov eax, dword [ebp + 0x10]
mov byte [eax], bl
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x44], 2
lea eax, [ebp - 0x170]
push eax
push esi
push str.PREPART
push dword [0x40d5a4]
call edi
mov ecx, dword [ebp - 0x44]
xor eax, eax
cmp dword [ebp - 0x40], ebx
setne al
lea eax, [eax + ecx*2]
mov eax, dword [eax*4 + 0x40434c]
cmp eax, 4
mov dword [ebp - 0x44], eax
jne 0x402308
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [0x40d5a0], ebx
jne 0x402396
cmp dword [ebp - 0xc], ebx
mov ecx, 0x40d0e4
jne 0x40235d
mov ecx, 0x40d5ac
cmp dword [ebp - 0x40], ebx
mov eax, str.The_PackageTracer_has_been_successfully__sinstalled
je 0x40236c
mov eax, str.Failed_to__sinstall_the_PackageTracer
push ecx
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x204]
push 0x1000
push str.PackageTracer_Installer
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [ebp - 0xc], ebx
jne 0x4023a0
call fcn.0040129a
push dword [ebp - 0x40]
mov esi, 0x40416c
push 0x40cec8
push esi
call fcn.004036f8
movzx eax, word [ebp - 0x38]
push eax
push 0x40cec4
push esi
call fcn.004036f8
add esp, 0x18
push dword [ebp - 0x40]
push str.result_x
push str.http:__imgfarm.com_images_nocache_tr_au1.gif
call fcn.004023e5
mov eax, dword [ebp - 0x40]
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret 0x10