Function at 0x41a7a0
Capabilities:
Accept command line arguments
Check if file exists
Contain obfuscated stackstrings
Encode data using base64
Get common file path
Get file attributes
Identify system language via api
Parse pe header
Query environment variable

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ee303
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ecx
mov eax, 0x12f4
call fcn.004b0170
mov eax, dword [0x54d104]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebx + 8]
xor edi, edi
mov dword [ebp - 0x1210], edi
xorps xmm0, xmm0
mov dword [ebp - 0x1220], eax
xor eax, eax
movups xmmword [ebp - 0xbd8], xmm0
mov dword [ebp - 0x1200], edi
mov dword [ebp - 0x1218], eax
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbc4], 7
mov word [ebp - 0xbd8], ax
mov dword [ebp - 4], eax
movups xmmword [ebp - 0xb60], xmm0
mov dword [ebp - 0xb50], eax
mov dword [ebp - 0xb4c], 7
mov word [ebp - 0xb60], ax
movups xmmword [ebp - 0xb30], xmm0
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xb1c], 7
mov word [ebp - 0xb30], ax
movups xmmword [ebp - 0xe90], xmm0
mov dword [ebp - 0xe80], eax
mov dword [ebp - 0xe7c], 7
mov word [ebp - 0xe90], ax
movups xmmword [ebp - 0xe48], xmm0
mov dword [ebp - 0xe38], eax
mov dword [ebp - 0xe34], 7
mov word [ebp - 0xe48], ax
movups xmmword [ebp - 0xe60], xmm0
mov dword [ebp - 0xe50], eax
mov dword [ebp - 0xe4c], 7
mov word [ebp - 0xe60], ax
movups xmmword [ebp - 0xc30], xmm0
mov dword [ebp - 0xc20], eax
mov dword [ebp - 0xc1c], 7
mov word [ebp - 0xc30], ax
push 0x34
push eax
lea eax, [ebp - 0xc18]
push eax
call fcn.004b23a0
xorps xmm0, xmm0
mov byte [ebp - 0xc00], 0
add esp, 0xc
mov dword [ebp - 0xbec], edi
movups xmmword [ebp - 0xbfc], xmm0
mov dword [ebp - 0xbe8], edi
push 0xc0
lea eax, [ebp - 0xf50]
push edi
push eax
call fcn.004b23a0
add esp, 0xc
lea ecx, [ebp - 0xf50]
call fcn.0040f000
push 0x74
lea eax, [ebp - 0xd9c]
mov dword [ebp - method.ProgressAnimator.virtual_0], 0x52bd28
push edi
push eax
call fcn.004b23a0
add esp, 0xc
mov dword [ebp - fcn.0040db40], vtable.ProgressCallback.0
mov dword [ebp - 0xd7c], edi
mov dword [ebp - 0xd78], edi
mov dword [ebp - 0xd74], edi
xorps xmm0, xmm0
mov dword [ebp - 0xd58], edi
movups xmmword [ebp - 0xd68], xmm0
mov dword [ebp - 0xd54], 7
xor eax, eax
mov word [ebp - 0xd68], ax
movups xmmword [ebp - 0xd50], xmm0
mov dword [ebp - 0xd40], eax
mov dword [ebp - 0xd3c], 7
mov word [ebp - 0xd50], ax
mov byte [ebp - 4], 0xb
push 0x38
mov dword [ebp - 0xd38], eax
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0xd2c], eax
call fcn.004af3f1
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0xd30], eax
lea eax, [ebp - 0xd98]
mov byte [ebp - 4], 0xc
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push ecx
push 1
sub esp, 8
call fcn.004776b0
mov ecx, dword [ebp - 0xd78]
add esp, 0x10
cmp dword [ebp - 0xd7c], ecx
mov dword [ebp - 0xd80], eax
cmovne ecx, dword [ebp - 0xd7c]
xor eax, eax
mov dword [ebp - 0xd78], ecx
lea ecx, [ebp - 0xd38]
mov byte [ebp - 0xd34], 0
xchg dword [ecx], eax
lea eax, [ebp - 0x1230]
mov byte [ebp - 0xd6c], 0
xorps xmm0, xmm0
mov dword [ebp - 0x1250], 0x64
push eax
lea ecx, [ebp - 0xd30]
movlpd qword [ebp - 0x1248], xmm0
mov dword [ebp - 0x124c], edi
mov byte [ebp - 0x1258], 1
mov dword [ebp - 0x1240], edi
mov dword [ebp - 0x1230], edi
call fcn.0040e5c0
movups xmm0, xmmword [ebp - 0x1258]
lea ecx, [ebp - 0xd30]
mov dword [ebp - 0x1208], 1
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x1248]
movups xmmword [eax + 0x10], xmm0
lea eax, [ebp - 0x1208]
push eax
call fcn.0040e5c0
movups xmm0, xmmword [ebp - 0x1258]
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x1248]
movups xmmword [eax + 0x10], xmm0
lea eax, [ebp - 0xd98]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0xd98]
mov dword [ebp - 0xd70], edi
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xorps xmm0, xmm0
mov dword [ebp - 0x1230], 0xffffffff
xor eax, eax
mov dword [ebp - 0xccc], edi
movups xmmword [ebp - 0xcdc], xmm0
mov dword [ebp - 0xcc8], 7
mov word [ebp - 0xcdc], ax
mov byte [ebp - 0x11f4], al
movq qword [ebp - 0xbe4], xmm0
mov dword [ebp - 0xbdc], eax
mov dword [ebp - 0x1224], eax
mov dword [ebp - 0x125c], eax
mov dword [ebp - 0xbe4], eax
mov dword [ebp - 0xbe0], eax
mov dword [ebp - 0xbdc], eax
lea ecx, [ebp - 0x11f0]
call fcn.0041f430
push 0x80
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b23a0
xorps xmm0, xmm0
mov dword [ebp - 0xc38], edi
xor eax, eax
mov dword [ebp - 0xc34], 7
movups xmmword [ebp - 0xc48], xmm0
add esp, 0xc
mov word [ebp - 0xc48], ax
movups xmmword [ebp - 0xc60], xmm0
mov dword [ebp - 0xc50], eax
mov dword [ebp - 0xc4c], 7
mov word [ebp - 0xc60], ax
movups xmmword [ebp - 0xcf4], xmm0
mov dword [ebp - 0xce4], eax
mov dword [ebp - 0xce0], 7
mov word [ebp - 0xcf4], ax
push 0x81e
push eax
mov word [ebp - 0xac8], ax
lea eax, [ebp - 0xac6]
push eax
call fcn.004b23a0
or eax, 0xffffffff
mov dword [ebp - 0xcb4], edi
mov dword [ebp - 0x1234], eax
xorps xmm0, xmm0
xor al, al
mov dword [ebp - 0xcb0], 7
mov dword [ebp - 0x1228], eax
add esp, 0xc
mov byte [ebp - 0x1211], al
xor eax, eax
movups xmmword [ebp - 0xcc4], xmm0
mov word [ebp - 0xcc4], ax
mov edi, 1
mov byte [ebp - 4], 0x14
mov ecx, edi
call fcn.0046f100
sub esp, 8
mov ecx, edi
call fcn.0047fdb0
add esp, 8
call fcn.00480000
xor ecx, ecx
call fcn.0046f2b0
call fcn.00480a20
movq xmm0, qword [str.sfxinst]
mov eax, dword [0x52bd4c]
mov dword [ebp - 0xad4], 0x37314446
mov ecx, dword [ebp - 0xad4]
movq qword [ebp - 0xb10], xmm0
xorps xmm0, xmm0
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xb00], ecx
lea ecx, [ebp - 0xae0]
mov dword [ebp - 0xad8], 0x37434235
mov eax, dword [ebp - 0xad8]
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xafc], 0x19
movlpd qword [ebp - 0xae0], xmm0
call fcn.0040add0
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0xae0]
test ecx, ecx
je 0x41acc3
push str.Entering_SFX_stub_guarded_code_section.
lea eax, [ebp - 0xb10]
push eax
push 2
call fcn.0040ef60
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0xadc]
mov dword [ebp - 0x1208], ecx
test ecx, ecx
je 0x41ad1c
or edi, 0xffffffff
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x41ad17
mov eax, dword [ecx]
mov esi, dword [eax]
mov ecx, esi
call dword [0x4f933c]
mov ecx, dword [ebp - 0x1208]
call esi
mov eax, edi
mov edi, dword [ebp - 0x1208]
lock xadd dword [edi + 8], eax
jne 0x41ad17
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4f933c]
mov ecx, edi
call esi
mov edi, 1
push 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0xc18]
call fcn.0041fc20
mov ecx, str.silent
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41ad40
sub ecx, edx
sar ecx, 1
push ecx
push str.silent
lea ecx, [ebp - 0xc18]
call fcn.004156a0
test eax, eax
je 0x41adaa
call fcn.00413640
sub esp, 8
mov esi, eax
mov ecx, esp
push str.silent
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00420140
push esi
push ecx
mov edx, str.stub_loading
mov ecx, eax
call fcn.00420d50
mov ecx, dword [ebp - 0x11f4]
add esp, 8
test al, al
movzx ecx, cl
cmove ecx, edi
mov dword [ebp - 0x11f4], ecx
mov ecx, str.AdminUpgrade
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41adb2
sub ecx, edx
sar ecx, 1
push ecx
push str.AdminUpgrade
lea ecx, [ebp - 0xc18]
call fcn.004156a0
mov ecx, dword [ebp - 0x11f4]
test eax, eax
movzx ecx, cl
cmovne ecx, edi
mov dword [ebp - 0x122c], ecx
mov byte [ebp - 0x1235], cl
mov ecx, 0x52a0b0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41adf4
sub ecx, edx
sar ecx, 1
push ecx
push 0x52a0b0
lea ecx, [ebp - 0xc18]
call fcn.004156a0
test eax, eax
mov dword [ebp - 0x1208], 0
setne al
xor ecx, ecx
mov byte [ebp - 0x1219], al
call fcn.004932c0
test al, al
je 0x41af99
lea ecx, [ebp - 0x1208]
call fcn.0041a6c0
test al, al
je 0x41af99
cmp dword [ebp - 0x1208], 0x3000
jae 0x41af99
cmp byte [ebp - 0x122c], 0
jne 0x41ae78
push 0x10
push str.Installation_failed
push str.We_are_sorry_but_the_installer_must_be_run_at_high_integrity_level__n_nTip:_Run_it_under_an_Administrator_account_or_use_a_different_browser_to_download_the_installer.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [0x52bd4c]
movq xmm0, qword [str.sfxinst]
mov dword [ebp - 0xad4], 0x37314446
mov ecx, dword [ebp - 0xad4]
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xb00], ecx
lea ecx, [ebp - 0xb10]
mov dword [ebp - 0xad8], 0x37434235
mov eax, dword [ebp - 0xad8]
movq qword [ebp - 0xb10], xmm0
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xafc], 0x19
call fcn.00420d70
lea ecx, [ebp - 0xcc4]
call fcn.0040aa40
lea ecx, [ebp - 0xcf4]
call fcn.0040aa40
lea ecx, [ebp - 0xc60]
call fcn.0040aa40
lea ecx, [ebp - 0xc48]
call fcn.0040aa40
lea ecx, [ebp - 0x11f0]
call fcn.0041f680
lea ecx, [ebp - 0xbe4]
call fcn.0040b430
lea ecx, [ebp - 0xcdc]
call fcn.0040aa40
lea ecx, [ebp - 0xd9c]
call fcn.0040daf0
lea ecx, [ebp - 0xf50]
call fcn.0040f0c0
lea ecx, [ebp - 0xc18]
call fcn.0041f650
lea ecx, [ebp - 0xc30]
call fcn.0040aa40
lea ecx, [ebp - 0xe60]
call fcn.0040aa40
lea ecx, [ebp - 0xe48]
call fcn.0040aa40
lea ecx, [ebp - 0xe90]
call fcn.0040aa40
lea ecx, [ebp - 0xb30]
call fcn.0040aa40
lea ecx, [ebp - 0xb60]
call fcn.0040aa40
lea ecx, [ebp - 0xbd8]
call fcn.0040aa40
mov eax, 0x7c
jmp 0x41f382
call fcn.004931d0
cmp eax, 5
jne 0x41aff1
call fcn.00413640
mov esi, eax
lea ecx, [ebp - 0xb48]
mov eax, dword [ebp - 0x1220]
push eax
call fcn.0040a9f0
push esi
mov byte [ebp - 4], 0x16
mov edi, 1
push ecx
mov edx, str._arm64
mov dword [ebp - 0x1200], edi
lea ecx, [ebp - 0xb48]
mov dword [ebp - 0x1210], edi
call fcn.00420d50
add esp, 8
mov byte [ebp - 0x11f9], 1
test al, al
je 0x41aff8
mov byte [ebp - 0x11f9], 0
mov dword [ebp - 4], 0x14
mov eax, dword [ebp - 0x1200]
test al, 1
je 0x41b023
and eax, 0xfffffffe
lea ecx, [ebp - 0xb48]
mov dword [ebp - 0x1200], eax
mov dword [ebp - 0x1210], eax
call fcn.0040aa40
cmp byte [ebp - 0x11f9], 0
je 0x41b16e
cmp byte [ebp - 0x122c], 0
jne 0x41b04d
push 0x10
push str.Installation_failed
push str.We_are_sorry_but_the_Avast_Antivirus_installer_cannot_run_on_arm64_devices._n_nTip:_Check_our_website_if_there_is_a_supported_version.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [0x52bd4c]
movq xmm0, qword [str.sfxinst]
mov dword [ebp - 0xad4], 0x37314446
mov ecx, dword [ebp - 0xad4]
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xb00], ecx
lea ecx, [ebp - 0xb10]
mov dword [ebp - 0xad8], 0x37434235
mov eax, dword [ebp - 0xad8]
movq qword [ebp - 0xb10], xmm0
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xafc], 0x19
call fcn.00420e20
lea ecx, [ebp - 0xcc4]
call fcn.0040aa40
lea ecx, [ebp - 0xcf4]
call fcn.0040aa40
lea ecx, [ebp - 0xc60]
call fcn.0040aa40
lea ecx, [ebp - 0xc48]
call fcn.0040aa40
lea ecx, [ebp - 0x11f0]
call fcn.0041f680
lea ecx, [ebp - 0xbe4]
call fcn.0040b430
lea ecx, [ebp - 0xcdc]
call fcn.0040aa40
lea ecx, [ebp - 0xd9c]
call fcn.0040daf0
lea ecx, [ebp - 0xf50]
call fcn.0040f0c0
lea ecx, [ebp - 0xc18]
call fcn.0041f650
lea ecx, [ebp - 0xc30]
call fcn.0040aa40
lea ecx, [ebp - 0xe60]
call fcn.0040aa40
lea ecx, [ebp - 0xe48]
call fcn.0040aa40
lea ecx, [ebp - 0xe90]
call fcn.0040aa40
lea ecx, [ebp - 0xb30]
call fcn.0040aa40
lea ecx, [ebp - 0xb60]
call fcn.0040aa40
lea ecx, [ebp - 0xbd8]
call fcn.0040aa40
mov eax, 0xc1
jmp 0x41f382
call fcn.00493240
test al, al
je 0x41b180
push ecx
call fcn.004554d0
add esp, 4
push 0xc0
lea eax, [ebp - 0x160]
push 0
push eax
call fcn.004b23a0
add esp, 0xc
lea ecx, [ebp - 0x160]
call fcn.0040f000
xor ecx, ecx
mov byte [ebp - 4], 0x17
call fcn.004136e0
push eax
lea ecx, [ebp - 0x160]
call fcn.0040f160
test eax, eax
jne 0x41b301
push 0x34
push eax
lea eax, [ebp - 0xdd0]
push eax
call fcn.004b23a0
add esp, 0xc
lea ecx, [ebp - 0xdd0]
call fcn.0041f3f0
push 0
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x18
call fcn.0040aae0
push eax
lea ecx, [ebp - 0xdd0]
call fcn.0041fc20
sub esp, 8
mov ecx, esp
push 0x529f3c
call fcn.00412540
lea ecx, [ebp - 0xdd0]
call fcn.00415560
test al, al
je 0x41b248
sub esp, 8
mov ecx, esp
push 0x529f3c
call fcn.00412540
lea ecx, [ebp - 0xdd0]
call fcn.00420140
mov ecx, eax
call fcn.0040aae0
push eax
call fcn.004c1a27
add esp, 4
mov dword [ebp - 0x1234], eax
sub esp, 8
mov ecx, esp
push str.sub_edition
call fcn.00412540
lea ecx, [ebp - 0xdd0]
call fcn.00415560
test al, al
je 0x41b293
sub esp, 8
mov ecx, esp
push str.sub_edition
call fcn.00412540
lea ecx, [ebp - 0xdd0]
call fcn.00420140
mov ecx, eax
call fcn.0040aae0
push eax
lea ecx, [ebp - 0xcc4]
call fcn.0040a790
sub esp, 8
mov ecx, esp
push 0x529f4c
call fcn.00412540
lea ecx, [ebp - 0xdd0]
call fcn.00415560
test al, al
je 0x41b2f6
sub esp, 8
mov ecx, esp
push 0x529f4c
call fcn.00412540
lea ecx, [ebp - 0xdd0]
call fcn.00420140
mov edx, 0x52a0ec
mov ecx, eax
call fcn.00415c20
mov ecx, dword [ebp - 0x1228]
test al, al
movzx ecx, cl
mov eax, 1
cmovne ecx, eax
mov dword [ebp - 0x1228], ecx
mov byte [ebp - 0x1211], cl
lea ecx, [ebp - 0xdd0]
call fcn.0041f650
lea ecx, [ebp - 0x160]
mov byte [ebp - 4], 0x14
call fcn.0040f0c0
push 0
lea eax, [ebp - 0x11f4]
mov dword [ebp - 0x11f4], 0
push eax
push 1
push str.O:BAG:BAD:P_A_CIOI_FA___SY__A_CIOI_FA___BA__A_CIOI_FRFX___BU_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
mov eax, dword [ebp - 0x11f4]
lea ecx, [ebp - 0xac8]
mov edx, str.._
mov dword [ebp - 0xaec], 0xc
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xae4], 0
call fcn.00420ed0
push 0
push 0x23
lea eax, [ebp - 0xac0]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.00450d30
mov ecx, eax
call fcn.0040aae0
push 0x528d0c
lea ecx, [ebp - 0xb48]
mov esi, eax
call fcn.0040a9f0
push esi
mov edx, eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1250]
call fcn.0040a360
add esp, 4
mov ecx, eax
call fcn.0040aae0
mov edx, eax
lea ecx, [ebp - 0xac8]
call fcn.00420ee0
lea ecx, [ebp - 0x1250]
call fcn.0040aa40
lea ecx, [ebp - 0xb48]
mov byte [ebp - 4], 0x14
call fcn.0040aa40
xor eax, eax
lea esi, [ebp - 0xaec]
cmp dword [ebp - 0x11f4], eax
lea ecx, [ebp - 0xb48]
cmove esi, eax
lea eax, [ebp - 0xac8]
push eax
call fcn.0040a9f0
mov edx, esi
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xb48]
call fcn.0048b3e0
lea ecx, [ebp - 0xb48]
mov byte [ebp - 4], 0x14
call fcn.0040aa40
push dword [ebp - 0x11f4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.00493450
test al, al
jne 0x41b439
call fcn.004934c0
test al, al
je 0x41b560
mov edx, str.SOFTWARE_
lea ecx, [ebp - 0xac8]
call fcn.00420ed0
lea ecx, [ebp - 0x2a8]
call fcn.00420ef0
call fcn.00450d30
mov ecx, eax
call fcn.0040aae0
mov edx, eax
lea ecx, [ebp - 0xac8]
call fcn.00420ee0
mov edx, 0x52adb8
lea ecx, [ebp - 0x2a8]
call fcn.00420f10
call fcn.00450d30
mov ecx, eax
call fcn.0040aae0
mov edx, eax
lea ecx, [ebp - 0x2a8]
call fcn.00420f10
lea edx, [ebp - 0x11f9]
lea ecx, [ebp - 0xac8]
call fcn.0048fce0
test al, al
je 0x41b4dd
cmp byte [ebp - 0x11f9], 0
je 0x41b4dd
lea edx, [ebp - 0x11f9]
lea ecx, [ebp - 0x2a8]
call fcn.0048fce0
test al, al
je 0x41b4dd
cmp byte [ebp - 0x11f9], 0
je 0x41b4dd
lea ecx, [ebp - 0xac8]
call fcn.0048fb40
lea edx, [ebp - 0x11f9]
lea ecx, [ebp - 0x2a8]
call fcn.0048fce0
test al, al
je 0x41b509
cmp byte [ebp - 0x11f9], 0
je 0x41b509
push ecx
lea edx, [ebp - 0xac8]
call fcn.0048ee10
jmp 0x41b55d
sub esp, 8
lea edx, [ebp - 0xac8]
call fcn.0048f000
add esp, 8
test al, al
je 0x41b54b
lea edx, [ebp - 0x11f9]
lea ecx, [ebp - 0xac8]
call fcn.0048fce0
test al, al
je 0x41b53c
cmp byte [ebp - 0x11f9], 0
jne 0x41b560
push ecx
lea edx, [ebp - 0x2a8]
lea ecx, [ebp - 0xac8]
jmp 0x41b558
push ecx
lea edx, [ebp - 0xac8]
lea ecx, [ebp - 0x2a8]
call fcn.0048f7f0
add esp, 4
call fcn.00493240
test al, al
je 0x41b57a
call fcn.00420f20
mov esi, eax
mov ecx, esi
call dword [0x4f933c]
call esi
call fcn.0042bb90
lea ecx, [ebp - 0xae0]
push ecx
mov ecx, eax
call fcn.0040b5d0
sub esp, 8
cmp byte [ebp - 0x1228], 0
mov ecx, esp
mov edi, dword [eax]
mov esi, dword [eax + 4]
je 0x41b5a7
push str.LogsClear.log
jmp 0x41b5ac
push str.LogsSetup.log
call fcn.00412540
push esi
push edi
lea ecx, [ebp - 0xcdc]
call fcn.0048b850
add esp, 0x10
push ecx
push 0x5c
lea ecx, [ebp - 0xcdc]
call fcn.00420350
push eax
push 0
lea eax, [ebp - 0x1250]
push eax
lea ecx, [ebp - 0xcdc]
call fcn.0040cee0
xor edx, edx
mov byte [ebp - 4], 0x1b
mov ecx, eax
call fcn.0048b3e0
lea ecx, [ebp - 0x1250]
mov byte [ebp - 4], 0x14
call fcn.0040aa40
movzx esi, byte [ebp - 0x1219]
lea ecx, [ebp - 0xcdc]
sub esp, 8
xor esi, 1
add esi, esi
call fcn.0040aae0
mov edx, esi
mov ecx, eax
call fcn.00419030
call fcn.00418f70
lea ecx, [ebp - 0x11f0]
call fcn.0043a910
call fcn.0046fe90
mov ecx, esp
push str.language
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00415560
sub esp, 8
mov ecx, esp
test al, al
je 0x41b688
push str.language
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00420140
mov ecx, eax
call fcn.0040aae0
push eax
call fcn.004c1a27
movzx esi, ax
add esp, 4
mov dword [ebp - 0x1208], esi
jmp 0x41b6e5
push str.langid
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00415560
test al, al
je 0x41b6d6
sub esp, 8
mov ecx, esp
push str.langid
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00420140
mov ecx, eax
call fcn.0040aae0
push eax
call fcn.004c1a27
movzx esi, ax
add esp, 4
mov dword [ebp - 0x1208], esi
jmp 0x41b6e5
call fcn.0041a570
movzx eax, word [eax + 0x40]
mov dword [ebp - 0x1208], eax
sub esp, 8
mov ecx, esp
push 0x52a100
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00420140
push eax
lea ecx, [ebp - 0xc48]
call fcn.0040d640
sub esp, 8
mov ecx, esp
push str.ga_clientid
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00415560
test al, al
je 0x41b75a
sub esp, 8
mov ecx, esp
push str.ga_clientid
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00420140
push eax
lea ecx, [ebp - 0xb48]
call fcn.0040d770
mov edi, dword [ebp - 0x1200]
or edi, 2
jmp 0x41b78d
lea eax, [ebp - 0xaf0]
push eax
call fcn.00492d80
add esp, 4
lea edx, [ebp - 0xb88]
lea ecx, [ebp - 0x1250]
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xb88], xmm0
call fcn.004197d0
mov edi, dword [ebp - 0x1200]
or edi, 4
push eax
lea ecx, [ebp - 0xc60]
mov dword [ebp - 0x1210], edi
mov dword [ebp - 0x1200], edi
call fcn.0040d690
mov eax, edi
test al, 4
je 0x41b7cb
and eax, 0xfffffffb
lea ecx, [ebp - 0x1250]
mov dword [ebp - 0x1200], eax
mov dword [ebp - 0x1210], eax
call fcn.0040aa40
mov eax, dword [ebp - 0x1200]
mov dword [ebp - 4], 0x14
test al, 2
je 0x41b7f0
and eax, 0xfffffffd
lea ecx, [ebp - 0xb48]
mov dword [ebp - 0x1200], eax
mov dword [ebp - 0x1210], eax
call fcn.0040aa40
sub esp, 8
mov ecx, esp
push str.edat_dir
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00415560
test al, al
je 0x41b83d
sub esp, 8
mov ecx, esp
push str.edat_dir
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00420140
push eax
lea ecx, [ebp - 0xb48]
call fcn.0040d770
or dword [ebp - 0x1200], 8
jmp 0x41b854
push 0x528d18
lea ecx, [ebp - 0x1250]
call fcn.0040a9f0
or dword [ebp - 0x1200], 0x10
push eax
lea ecx, [ebp - 0xcf4]
call fcn.0040d690
mov eax, dword [ebp - 0x1200]
test al, 0x10
je 0x41b884
and eax, 0xffffffef
lea ecx, [ebp - 0x1250]
mov dword [ebp - 0x1200], eax
call fcn.0040aa40
mov eax, dword [ebp - 0x1200]
mov dword [ebp - 4], 0x14
test al, 8
je 0x41b8a3
and eax, 0xfffffff7
lea ecx, [ebp - 0xb48]
mov dword [ebp - 0x1200], eax
call fcn.0040aa40
sub esp, 8
mov ecx, esp
push str.sub_edition
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00415560
test al, al
je 0x41b8dd
sub esp, 8
mov ecx, esp
push str.sub_edition
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00420140
jmp 0x41b8e3
lea eax, [ebp - 0xcc4]
push eax
lea ecx, [ebp - 0xcc4]
call fcn.0040d640
sub esp, 8
mov ecx, esp
push str.ifeo
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00415560
test al, al
sete byte [ebp - 0x1236]
xor ecx, ecx
call fcn.004136e0
movq xmm0, qword [str.sfxinst]
mov dword [ebp - 0x11f4], eax
mov eax, dword [0x52bd4c]
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xad8], 0x37434235
mov eax, dword [ebp - 0xad8]
mov dword [ebp - 0xb04], eax
lea eax, [ebp - 0x11f4]
mov dword [ebp - 0xad4], 0x37314446
mov ecx, dword [ebp - 0xad4]
mov dword [ebp - 0xb00], ecx
lea ecx, [ebp - 0xb10]
push eax
movq qword [ebp - 0xb10], xmm0
mov dword [ebp - 0xafc], 0x19
call fcn.00420fa0
add esp, 4
mov ecx, 1
call fcn.004932c0
test al, al
jne 0x41bb92
mov ecx, dword [ebp - 0x1234]
call fcn.004198b0
test al, al
je 0x41bb92
cmp byte [ebp - 0x122c], 0
jne 0x41b9c7
push 0x10
push str.Unsupported_system
push str.Your_operating_system_is_not_supported_for_Avast_One_installation._Please_upgrade_your_OS_at_least_to_Windows_7_SP1.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
movq xmm0, qword [str.sfxinst]
mov eax, dword [0x52bd4c]
mov dword [ebp - 0xad4], 0x37314446
mov ecx, dword [ebp - 0xad4]
movq qword [ebp - 0xb10], xmm0
xorps xmm0, xmm0
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xb00], ecx
lea ecx, [ebp - 0xae0]
mov dword [ebp - 0xad8], 0x37434235
mov eax, dword [ebp - 0xad8]
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xafc], 0x19
movlpd qword [ebp - 0xae0], xmm0
call fcn.0040add0
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0xae0]
test ecx, ecx
je 0x41ba4f
push str.Your_operating_system_is_not_supported_for_Avast_One_installation._Please_upgrade_your_OS_at_least_to_Windows_7_SP1.
lea eax, [ebp - 0xb10]
push eax
push 7
call fcn.0040ef60
mov byte [ebp - 4], 0x14
or edi, 0xffffffff
mov ecx, dword [ebp - 0xadc]
mov dword [ebp - 0x11f4], ecx
test ecx, ecx
je 0x41baa7
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x41baa7
mov eax, dword [ecx]
mov esi, dword [eax]
mov ecx, esi
call dword [0x4f933c]
mov ecx, dword [ebp - 0x11f4]
call esi
mov ecx, dword [ebp - 0x11f4]
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x41baa7
mov eax, dword [ecx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4f933c]
mov ecx, dword [ebp - 0x11f4]
call esi
xor esi, esi
call fcn.0046fc60
call fcn.00480130
sub esp, 8
xor ecx, ecx
call fcn.0047fdb0
add esp, 8
xor ecx, ecx
call fcn.0046f100
mov eax, dword [ebp - 0xb20]
mov dword [ebp - 0x1230], eax
test eax, eax
je 0x41f0e2
cmp dword [ebp - 0xb1c], 8
lea edx, [ebp - 0xb30]
mov ecx, str.Reboot.txt
cmovae edx, dword [ebp - 0xb30]
sub esp, 8
mov eax, esp
mov dword [ebp - 0x1204], eax
mov dword [eax], str.Reboot.txt
lea eax, [ecx + 2]
mov dword [ebp - 0x11f8], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41bb10
sub ecx, dword [ebp - 0x11f8]
mov eax, dword [ebp - 0x1204]
push dword [ebp - 0x1230]
sar ecx, 1
push edx
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xb60]
call fcn.0048b850
add esp, 0x10
lea eax, [ebp - 0xb60]
cmp dword [ebp - 0xb4c], 8
cmovae eax, dword [ebp - 0xb60]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41bb6c
mov byte [ebp - 0x1211], 1
test al, 0x10
je 0x41bb73
mov byte [ebp - 0x1211], 0
cmp byte [ebp - 0x1219], 0
lea ecx, [ebp - 0xb30]
je 0x41f0c9
mov dl, 1
call fcn.0048c5c0
jmp 0x41f0d4
push str.wintrust.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41bbc5
push str.CryptCATAdminAcquireContext2
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
setne al
test al, al
jne 0x41bc59
mov ecx, dword [ebp - 0x1234]
call fcn.004198b0
test al, al
je 0x41bc59
cmp byte [ebp - 0x122c], 0
jne 0x41bbf5
push 0x10
push str.Unsupported_system
push str.Your_operating_system_is_not_supported_for_Avast_One_installation._Windows_7_KB3033929_is_required.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [0x52bd4c]
movq xmm0, qword [str.sfxinst]
mov dword [ebp - 0xad4], 0x37314446
mov ecx, dword [ebp - 0xad4]
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xb00], ecx
lea ecx, [ebp - 0xb10]
mov dword [ebp - 0xad8], 0x37434235
mov eax, dword [ebp - 0xad8]
movq qword [ebp - 0xb10], xmm0
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xafc], 0x19
call fcn.00421060
or edi, 0xffffffff
jmp 0x41baa7
lea eax, [ebp - 0x1230]
push eax
sub esp, 8
lea eax, [ebp - 0xc30]
lea edx, [ebp - 0xe60]
lea ecx, [ebp - 0xe48]
push eax
call fcn.0043a6c0
add esp, 0x10
mov byte [ebp - 0x11f9], al
test al, al
je 0x41bcae
cmp dword [ebp - 0x111c], 8
lea ecx, [ebp - 0x1130]
lea eax, [ebp - 0xa0]
cmovae ecx, dword [ebp - 0x1130]
push ecx
push 0x40
push eax
call fcn.004c6de8
add esp, 0xc
cmp word [ebp - 0xa0], 0
jne 0x41bdd1
mov ecx, 0x52a05c
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41bcc4
sub ecx, edx
sar ecx, 1
push ecx
push 0x52a05c
lea ecx, [ebp - 0xc18]
call fcn.004156a0
test eax, eax
je 0x41bd36
sub esp, 8
mov ecx, esp
push 0x52a05c
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00420140
cmp dword [eax + 0x10], 0x24
jne 0x41bd36
sub esp, 8
mov ecx, esp
push 0x52a05c
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00420140
mov ecx, eax
call fcn.0040aae0
mov edx, eax
lea ecx, [ebp - 0xa0]
call fcn.00421110
cmp word [ebp - 0xa0], 0
jne 0x41bdd1
call fcn.00492c80
mov dword [ebp - 0xb88], eax
mov dword [ebp - 0xb84], edx
call fcn.00492c80
mov dword [ebp - 0xb80], eax
lea ecx, [ebp - 0x1250]
mov eax, dword [ebp - 0xb82]
and eax, 0xfff
mov dword [ebp - 0xb7c], edx
or eax, 0x4000
lea edx, [ebp - 0xb88]
mov word [ebp - 0xb82], ax
mov al, byte [ebp - 0xb80]
and al, 0x3f
or al, 0x80
mov byte [ebp - 0xb80], al
movups xmm0, xmmword [ebp - 0xb88]
movups xmmword [ebp - 0xb88], xmm0
call fcn.004197d0
cmp dword [eax + 0x14], 8
jb 0x41bdb4
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xa0]
push 0x40
push eax
call fcn.004c6de8
add esp, 0xc
lea ecx, [ebp - 0x1250]
call fcn.0040aa40
cmp byte [ebp - 0x1228], 0
jne 0x41c095
cmp byte [ebp - 0x11f9], 0
jne 0x41c095
cmp byte [ebp - 0x1040], 0
jne 0x41c095
lea ecx, [ebp - 0xb78]
call fcn.0040a7c0
mov byte [ebp - 4], 0x1f
call fcn.00450c10
push 0x528ca0
mov edx, eax
lea ecx, [ebp - 0x1250]
call fcn.0040a2f0
add esp, 4
mov ecx, eax
call fcn.0040aae0
mov ecx, eax
call fcn.004144c0
lea ecx, [ebp - 0x1250]
mov byte [ebp - 0x1209], al
call fcn.0040aa40
call fcn.00450c10
cmp byte [ebp - 0x1209], 0
lea ecx, [ebp - 0x1250]
mov edx, eax
je 0x41be7f
push 0x528ca0
call fcn.0040a2f0
add esp, 4
lea ecx, [ebp - 0xb78]
push eax
call fcn.0040d690
lea ecx, [ebp - 0x1250]
call fcn.0040aa40
jmp 0x41bf0f
push str.FsBlk
call fcn.0040a2f0
add esp, 4
mov ecx, eax
call fcn.0040aae0
mov ecx, eax
call fcn.004144c0
lea ecx, [ebp - 0x1250]
mov byte [ebp - 0x1209], al
call fcn.0040aa40
cmp byte [ebp - 0x1209], 0
je 0x41bee7
call fcn.00450c10
push str.FsBlk
mov edx, eax
lea ecx, [ebp - 0x1250]
call fcn.0040a2f0
add esp, 4
lea ecx, [ebp - 0xb78]
push eax
call fcn.0040d690
lea ecx, [ebp - 0x1250]
call fcn.0040aa40
jmp 0x41bf0f
call fcn.004519b0
mov ecx, eax
call fcn.0040aae0
mov ecx, eax
call fcn.004144c0
test al, al
je 0x41bf0f
call fcn.004519b0
push eax
lea ecx, [ebp - 0xb78]
call fcn.0040d640
cmp dword [ebp - 0xb68], 0
je 0x41c086
call int.004518d0
push eax
lea ecx, [ebp - 0xb48]
call fcn.0040d770
cmp byte [ebp - 0x122c], 0
mov eax, 0xa003
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x1218], eax
jne 0x41bfcf
call fcn.00450a60
cmp eax, 2
mov ecx, str.avastClear.exe
mov edi, str.avgClear.exe
cmovne edi, ecx
lea ecx, [ebp - 0xb78]
call fcn.0040aae0
lea ecx, [ebp - 0xb48]
mov esi, eax
call fcn.0040aae0
push edi
push esi
push eax
push str.The_installer_has_detected_corrupted__s_installation_on_this_computer__service__s_is_running___thus_this_installer_cannot_continue._Use_the__s_utility_to_fix_the_problem_or_contact_our_support_team.
lea eax, [ebp - 0xac8]
push 0x410
push eax
call fcn.00413490
add esp, 0x18
lea ecx, [ebp - 0xb48]
call fcn.0040aae0
push eax
push str.Corrupted__s_detected.
lea eax, [ebp - 0x2a0]
push 0x100
push eax
call fcn.00413490
add esp, 0x10
lea eax, [ebp - 0x2a0]
push 0x10
push eax
lea eax, [ebp - 0xac8]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0xb78]
call fcn.0040aae0
lea ecx, [ebp - 0xb48]
mov dword [ebp - 0x1230], eax
call fcn.0040aae0
movq xmm0, qword [str.sfxinst]
mov dword [ebp - 0x1220], eax
mov eax, dword [0x52bd4c]
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xad8], 0x37434235
mov eax, dword [ebp - 0xad8]
mov dword [ebp - 0xb04], eax
lea eax, [ebp - 0x1230]
push eax
mov dword [ebp - 0xad4], 0x37314446
lea eax, [ebp - 0x1220]
mov ecx, dword [ebp - 0xad4]
mov dword [ebp - 0xb00], ecx
lea ecx, [ebp - 0xb10]
push eax
movq qword [ebp - 0xb10], xmm0
mov dword [ebp - 0xafc], 0x19
call fcn.00421120
add esp, 8
lea ecx, [ebp - 0xb48]
call fcn.0040aa40
lea ecx, [ebp - 0xb78]
mov byte [ebp - 4], 0x14
call fcn.0040aa40
mov esi, dword [ebp - 0x1218]
or edi, 0xffffffff
jmp 0x41baa9
lea ecx, [ebp - 0xb78]
mov byte [ebp - 4], 0x14
call fcn.0040aa40
push 0x554e00
lea ecx, [ebp - 0xf50]
call fcn.0040f160
mov esi, eax
mov dword [ebp - 0x1218], esi
mov dword [ebp - 0x11f4], esi
test esi, esi
je 0x41c180
cmp byte [ebp - 0x122c], 0
jne 0x41c0fc
xor ecx, ecx
call fcn.004136e0
push esi
push eax
push str.The_installer_cannot_open_the_SFX_archive__s.__code_0x_x__r_n_r_nIts_probably_caused_by_corrupted_installer_thus_please_try_to_download_it_again.
lea eax, [ebp - 0xac8]
push 0x410
push eax
call fcn.00413490
add esp, 0x14
lea eax, [ebp - 0xac8]
push 0x10
push str.Installation_failed
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [0x52bd4c]
mov edx, str.Cannot_open_the_SFX_archive__s__code_0x_x_
movq xmm0, qword [str.sfxinst]
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xad8], 0x37434235
mov eax, dword [ebp - 0xad8]
mov dword [ebp - 0xb04], eax
lea eax, [ebp - 0x11f4]
push eax
mov dword [ebp - 0xad4], 0x37314446
lea eax, [ebp - 0x1230]
mov ecx, dword [ebp - 0xad4]
mov dword [ebp - 0xb00], ecx
lea ecx, [ebp - 0xb10]
push eax
mov dword [ebp - 0x1230], 0x554e00
movq qword [ebp - 0xb10], xmm0
mov dword [ebp - 0xafc], 0x19
call fcn.00421140
add esp, 8
or edi, 0xffffffff
jmp 0x41baa9
lea ecx, [ebp - 0x1250]
call fcn.004137a0
mov esi, eax
lea eax, [ebp - 0xb30]
cmp eax, esi
je 0x41c1c8
mov ecx, eax
call fcn.0040aa40
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0xb30], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0xb20], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
lea ecx, [ebp - 0x1250]
call fcn.0040aa40
cmp dword [ebp - 0xb1c], 8
lea eax, [ebp - 0xb30]
mov edx, str._TMPPATH_
lea ecx, [ebp - 0xf50]
cmovae eax, dword [ebp - 0xb30]
push eax
call fcn.004140f0
add esp, 4
lea eax, [ebp - 0xf50]
cmp dword [ebp - 0xf3c], 8
lea ecx, [ebp - 0xc18]
cmovae eax, dword [ebp - 0xf50]
push 0
push eax
call fcn.0041fc20
mov esi, dword [ebp - 0xc38]
test esi, esi
jne 0x41c271
sub esp, 8
mov ecx, esp
push 0x52a100
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00415560
test al, al
je 0x41c271
sub esp, 8
mov ecx, esp
push 0x52a100
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00420140
push eax
lea ecx, [ebp - 0xc48]
call fcn.0040d640
mov esi, dword [ebp - 0xc38]
cmp dword [ebp - 0xcb4], 0
je 0x41c2a5
lea eax, [ebp - 0xcc4]
push eax
sub esp, 0xc
mov ecx, esp
push str.sub_edition
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00420140
add esp, 4
mov ecx, eax
call fcn.0040d640
test esi, esi
jne 0x41c2f8
call fcn.00413640
xor ecx, ecx
mov esi, eax
call fcn.004136e0
push eax
lea ecx, [ebp - 0x1250]
call fcn.0040a9f0
mov byte [ebp - 4], 0x21
mov edx, str._x64.exe
mov edi, dword [ebp - 0x1200]
push ecx
or edi, 0x20
mov ecx, eax
push esi
mov dword [ebp - 0x1200], edi
mov dword [ebp - 0x1210], edi
call fcn.00421200
add esp, 8
mov byte [ebp - 0x1209], 1
test al, al
je 0x41c2ff
mov byte [ebp - 0x1209], 0
mov dword [ebp - 4], 0x14
mov eax, dword [ebp - 0x1200]
test al, 0x20
je 0x41c324
and eax, 0xffffffdf
lea ecx, [ebp - 0x1250]
mov dword [ebp - 0x1200], eax
call fcn.0040aa40
cmp byte [ebp - 0x1209], 0
je 0x41c540
xorps xmm0, xmm0
mov dword [ebp - 0xae4], 0
push 0x528d0c
lea ecx, [ebp - 0x128c]
movq qword [ebp - 0xaec], xmm0
call fcn.0040a9f0
xor ecx, ecx
mov byte [ebp - 4], 0x22
call fcn.004136e0
push eax
lea ecx, [ebp - 0xb48]
call fcn.0040a9f0
sub esp, 8
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x128c]
lea edx, [ebp - 0xb48]
lea ecx, [ebp - 0xaec]
push 1
push eax
call fcn.0040c170
add esp, 0x10
lea ecx, [ebp - 0xb48]
call fcn.0040aa40
lea ecx, [ebp - 0x128c]
mov byte [ebp - 4], 0x26
call fcn.0040aa40
lea ecx, [ebp - 0xaec]
call fcn.0040afe0
cmp eax, 2
jb 0x41c531
mov eax, dword [ebp - 0xae8]
lea ecx, [ebp - 0xb10]
add eax, 0xffffffe8
push eax
call fcn.0040d770
sub esp, 8
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xb10]
call fcn.004203a0
mov esi, eax
cmp esi, 0xffffffff
je 0x41c526
push esi
push 0x52b4f8
lea ecx, [ebp - 0xb10]
call fcn.0040b550
cmp eax, 0xffffffff
jne 0x41c421
push esi
push 0x52a834
lea ecx, [ebp - 0xb10]
call fcn.0040b550
cmp eax, 0xffffffff
je 0x41c526
sub eax, esi
lea ecx, [ebp - 0xb10]
dec eax
push eax
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0xba8]
push eax
call fcn.0040cee0
mov byte [ebp - 4], 0x28
cmp dword [ebp - 0xb98], 3
jne 0x41c51b
push 1
lea ecx, [ebp - 0xba8]
call fcn.0040d670
cmp word [eax], 0x30
jb 0x41c51b
push 1
lea ecx, [ebp - 0xba8]
call fcn.0040d670
cmp word [eax], 0x39
ja 0x41c51b
call fcn.00450a60
cmp eax, 2
lea ecx, [ebp - 0xb48]
lea eax, [ebp - 0xba8]
push eax
jne 0x41c4a4
mov edx, str.mmm_bav_ppc_999_
call fcn.00421250
add esp, 4
mov byte [ebp - 4], 0x29
jmp 0x41c4b5
mov edx, str.mmm_ava_ppc_999_
call fcn.00421250
add esp, 4
mov byte [ebp - 4], 0x2a
push 0x52b4fc
mov edx, eax
lea ecx, [ebp - 0x1250]
call fcn.0040a360
add esp, 4
lea ecx, [ebp - 0xc48]
push eax
call fcn.0040d690
lea ecx, [ebp - 0x1250]
call fcn.0040aa40
lea ecx, [ebp - 0xb48]
mov byte [ebp - 4], 0x28
call fcn.0040aa40
lea eax, [ebp - 0xc48]
push eax
sub esp, 0xc
mov ecx, esp
push 0x52a100
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00420140
add esp, 4
mov ecx, eax
call fcn.0040d640
lea ecx, [ebp - 0xba8]
call fcn.0040aa40
lea ecx, [ebp - 0xb10]
call fcn.0040aa40
lea ecx, [ebp - 0xaec]
mov byte [ebp - 4], 0x14
call fcn.0040b810
lea ecx, [ebp - 0x11f4]
mov dword [ebp - 0x11f4], 0
call fcn.00482130
xorps xmm0, xmm0
mov dword [ebp - 0xc9c], 0
xor eax, eax
mov dword [ebp - 0xc98], 7
movups xmmword [ebp - 0xcac], xmm0
mov word [ebp - 0xcac], ax
mov byte [ebp - 4], 0x2b
cmp dword [ebp - 0x11f4], 2
jl 0x41c59e
push str.Loading
lea ecx, [ebp - 0xcac]
call fcn.0040a790
jmp 0x41c62c
cmp byte [ebp - 0x1228], 0
je 0x41c5c7
push str._Clear
push ecx
call int.004518d0
add esp, 4
lea ecx, [ebp - 0x1250]
mov edx, eax
call fcn.0040a2f0
add esp, 4
jmp 0x41c615
mov esi, dword [ebp - 0x1234]
mov ecx, esi
call fcn.004198b0
test al, al
je 0x41c5fa
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ecx, 0x409
cmp ax, cx
jne 0x41c5fa
push str.Setting_up_Avast_One_installation...
lea ecx, [ebp - 0xcac]
call fcn.0040a790
jmp 0x41c62c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov edx, esi
push eax
push ecx
lea ecx, [ebp - 0x1250]
call fcn.00419920
add esp, 8
push eax
lea ecx, [ebp - 0xcac]
call fcn.0040d690
lea ecx, [ebp - 0x1250]
call fcn.0040aa40
mov ecx, dword [ebp - 0x1234]
cmp ecx, 0xffffffff
jne 0x41c65b
mov ecx, dword [ebp - 0x106c]
cmp ecx, 0xffffffff
jne 0x41c65b
call fcn.00450a60
sub eax, 2
neg eax
sbb eax, eax
add eax, 0x3ea
mov dword [ebp - 0x11f4], eax
jmp 0x41c68f
cmp ecx, 0x13
jne 0x41c667
mov esi, 0x3eb
jmp 0x41c695
call fcn.004198b0
test al, al
je 0x41c677
mov esi, 0x3ec
jmp 0x41c695
call fcn.00419900
xor ecx, ecx
test al, al
setne cl
add ecx, 0x3e9
mov dword [ebp - 0x11f4], ecx
mov esi, dword [ebp - 0x11f4]
push 0x58
lea eax, [ebp - 0x1008]
push 0
push eax
call fcn.004b23a0
add esp, 0xc
lea eax, [ebp - 0xcac]
push eax
push esi
push ecx
lea ecx, [ebp - 0x1008]
call fcn.00417750
lea eax, [ebp - 0xc7c]
mov byte [ebp - 4], 0x2c
push eax
lea ecx, [ebp - 0xd9c]
call fcn.0040db40
lea eax, [ebp - 0x1008]
push eax
lea ecx, [ebp - 0xd9c]
call fcn.0040db40
cmp byte [ebp - 0x122c], 0
jne 0x41c6f8
lea ecx, [ebp - 0x1008]
call fcn.00418080
cmp dword [ebp - 0xb1c], 8
lea edx, [ebp - 0xb30]
xorps xmm0, xmm0
mov dword [ebp - 0xb98], 0
cmovae edx, dword [ebp - 0xb30]
mov ecx, edx
mov dword [ebp - 0xb94], 0
movups xmmword [ebp - 0xba8], xmm0
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41c730
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0xba8]
call fcn.0040a960
mov byte [ebp - 4], 0x2d
mov eax, 0x490
mov esi, dword [ebp - 0xec0]
mov edi, dword [ebp - 0xebc]
mov dword [ebp - 0x11f4], eax
cmp esi, edi
je 0x41c81a
nop
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x41c77a
mov ecx, dword [esi]
mov edx, dword [esi + 0x10]
push 0xb
push str.servers.def
push 0
call fcn.0040c2a0
add esp, 0xc
test eax, eax
je 0x41c79e
add esi, 0x40
cmp esi, edi
jne 0x41c770
jmp 0x41c81a
cmp dword [ebp - 0xb94], 8
lea edx, [ebp - 0xba8]
xorps xmm0, xmm0
mov dword [ebp - 0xb00], 0
cmovae edx, dword [ebp - 0xba8]
mov ecx, edx
mov dword [ebp - 0xafc], 0
movups xmmword [ebp - 0xb10], xmm0
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41c7d5
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0xb10]
call fcn.0040a960
push ecx
push esi
lea eax, [ebp - 0xb10]
mov byte [ebp - 4], 0x2e
push eax
lea ecx, [ebp - 0xf50]
call fcn.00410490
lea ecx, [ebp - 0xb10]
mov dword [ebp - 0x11f4], eax
call fcn.0040aa40
lea ecx, [ebp - 0xba8]
mov byte [ebp - 4], 0x2c
call fcn.0040aa40
mov eax, dword [ebp - 0x11f4]
test eax, eax
je 0x41c8ca
mov edx, eax
lea ecx, [ebp - 0x1250]
call fcn.0042ad50
mov ecx, eax
mov byte [ebp - 4], 0x2f
call fcn.0040aae0
movq xmm0, qword [str.sfxinst]
mov dword [ebp - 0x11f4], eax
mov eax, dword [0x52bd4c]
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xad8], 0x37434235
mov eax, dword [ebp - 0xad8]
mov dword [ebp - 0xb04], eax
lea eax, [ebp - 0x11f4]
mov dword [ebp - 0xad4], 0x37314446
mov ecx, dword [ebp - 0xad4]
mov dword [ebp - 0xb00], ecx
lea ecx, [ebp - 0xb10]
push eax
movq qword [ebp - 0xb10], xmm0
mov dword [ebp - 0xafc], 0x19
call fcn.004212b0
add esp, 4
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x1250]
call fcn.0040aa40
cmp byte [ebp - 0x1228], 0
jne 0x41d327
call fcn.0041a400
test al, al
je 0x41c947
sub esp, 8
mov ecx, esp
push 0x529f4c
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00415560
test al, al
je 0x41c947
sub esp, 8
mov ecx, esp
push 0x529f4c
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00420140
cmp dword [eax + 0x10], 0
jne 0x41c947
push 0x52a0f8
sub esp, 0xc
mov ecx, esp
push 0x529f4c
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00420140
add esp, 4
mov ecx, eax
call fcn.0040a790
cmp dword [ebp - 0xce4], 0
je 0x41ce8f
lea ecx, [ebp - 0xcf4]
call fcn.0048b000
test al, al
je 0x41ce18
push str..edat
lea ecx, [ebp - 0xb48]
call fcn.0040a9f0
push 1
lea eax, [ebp - 0xb48]
mov byte [ebp - 4], 0x30
push 0
push eax
lea edx, [ebp - 0xcf4]
lea ecx, [ebp - 0xb84]
call fcn.0048cbc0
add esp, 0xc
lea ecx, [ebp - 0xb48]
mov byte [ebp - 4], 0x32
call fcn.0040aa40
mov esi, dword [ebp - 0xb84]
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0x11f4], esi
mov dword [ebp - 0x1204], eax
cmp esi, eax
je 0x41ce07
nop dword [eax]
lea eax, [ebp - 0xae0]
mov ecx, esi
push eax
call fcn.0040b5d0
lea ecx, [ebp - 0xb78]
push dword [eax + 4]
push dword [eax]
call fcn.0048b0a0
add esp, 8
lea eax, [ebp - 0xb18]
mov byte [ebp - 4], 0x33
push eax
mov ecx, esi
call fcn.0040b5d0
lea ecx, [ebp - 0xbc0]
push dword [eax + 4]
push dword [eax]
call fcn.0048b020
add esp, 8
mov byte [ebp - 4], 0x34
call fcn.00413640
mov dword [ebp - 0x1210], eax
lea ecx, [ebp - 0xb78]
lea eax, [ebp - 0x12f0]
push eax
call fcn.0040b5d0
sub esp, 8
mov ecx, esp
mov edi, dword [eax]
mov esi, dword [eax + 4]
push str.elic
call fcn.00412540
mov edx, dword [ebp - 0x1210]
or ecx, 0xffffffff
push esi
push edi
call fcn.004136c0
add esp, 0x10
test eax, eax
jne 0x41ca6c
push str.license.avastlic
jmp 0x41cbfe
call fcn.00413640
mov dword [ebp - 0x1210], eax
lea ecx, [ebp - 0xb78]
lea eax, [ebp - 0x12e8]
push eax
call fcn.0040b5d0
sub esp, 8
mov ecx, esp
mov edi, dword [eax]
mov esi, dword [eax + 4]
push str.ebcf
call fcn.00412540
mov edx, dword [ebp - 0x1210]
or ecx, 0xffffffff
push esi
push edi
call fcn.004136c0
add esp, 0x10
test eax, eax
jne 0x41cabe
push str.bcc.cfg.tmp
jmp 0x41cbfe
call fcn.00413640
mov dword [ebp - 0x1210], eax
lea ecx, [ebp - 0xb78]
lea eax, [ebp - 0x12d8]
push eax
call fcn.0040b5d0
sub esp, 8
mov ecx, esp
mov edi, dword [eax]
mov esi, dword [eax + 4]
push str.ebpk
call fcn.00412540
mov edx, dword [ebp - 0x1210]
or ecx, 0xffffffff
push esi
push edi
call fcn.004136c0
add esp, 0x10
test eax, eax
jne 0x41cb10
push str.bcpub.key.tmp
jmp 0x41cbfe
call fcn.00413640
mov dword [ebp - 0x1210], eax
lea ecx, [ebp - 0xb78]
lea eax, [ebp - 0x12c8]
push eax
call fcn.0040b5d0
sub esp, 8
mov ecx, esp
mov edi, dword [eax]
mov esi, dword [eax + 4]
push str.erid
call fcn.00412540
mov edx, dword [ebp - 0x1210]
or ecx, 0xffffffff
push esi
push edi
call fcn.004136c0
add esp, 0x10
test eax, eax
jne 0x41cb62
push str.rid.bin
jmp 0x41cbfe
call fcn.00413640
mov dword [ebp - 0x1210], eax
lea ecx, [ebp - 0xb78]
lea eax, [ebp - 0x12d0]
push eax
call fcn.0040b5d0
sub esp, 8
mov ecx, esp
mov edi, dword [eax]
mov esi, dword [eax + 4]
push str.ecoo
call fcn.00412540
mov edx, dword [ebp - 0x1210]
or ecx, 0xffffffff
push esi
push edi
call fcn.004136c0
add esp, 0x10
test eax, eax
jne 0x41cbb1
push str.cookie.bin
jmp 0x41cbfe
call fcn.00413640
mov dword [ebp - 0x1210], eax
lea ecx, [ebp - 0xb78]
lea eax, [ebp - 0x12e0]
push eax
call fcn.0040b5d0
sub esp, 8
mov ecx, esp
mov edi, dword [eax]
mov esi, dword [eax + 4]
push str.eapt
call fcn.00412540
mov edx, dword [ebp - 0x1210]
or ecx, 0xffffffff
push esi
push edi
call fcn.004136c0
add esp, 0x10
test eax, eax
jne 0x41cc09
push str.pairing.bin
lea ecx, [ebp - 0xbc0]
call fcn.0040a790
lea ecx, [ebp - 0xc78]
call fcn.0040a7c0
lea eax, [ebp - 0x12f8]
mov byte [ebp - 4], 0x35
push eax
lea ecx, [ebp - 0xbc0]
call fcn.0040b5d0
lea ecx, [ebp - 0xb30]
mov edi, dword [eax]
mov esi, dword [eax + 4]
lea eax, [ebp - 0xad4]
push eax
call fcn.0040b5d0
push esi
push edi
lea ecx, [ebp - 0xc78]
push dword [eax + 4]
push dword [eax]
call fcn.0048b850
mov esi, dword [ebp - 0x11f4]
lea edx, [ebp - 0xc78]
add esp, 8
mov ecx, esi
call fcn.0048c470
add esp, 8
test al, al
je 0x41cd08
lea ecx, [ebp - 0xc78]
call fcn.0040aae0
lea ecx, [ebp - 0xb78]
mov dword [ebp - 0x11f4], eax
call fcn.0040aae0
movq xmm0, qword [str.sfxinst]
mov dword [ebp - 0x1210], eax
mov eax, dword [0x52bd4c]
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0x1268], 0x37434235
mov eax, dword [ebp - 0x1268]
mov dword [ebp - 0xb04], eax
lea eax, [ebp - 0x11f4]
push eax
mov dword [ebp - 0x1264], 0x37314446
lea eax, [ebp - 0x1210]
mov ecx, dword [ebp - 0x1264]
mov dword [ebp - 0xb00], ecx
lea ecx, [ebp - 0xb10]
push eax
movq qword [ebp - 0xb10], xmm0
mov dword [ebp - 0xafc], 0x19
call fcn.00421370
add esp, 8
jmp 0x41cdcd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x1250]
call fcn.0042ad50
mov ecx, eax
mov byte [ebp - 4], 0x36
call fcn.0040aae0
lea ecx, [ebp - 0xc78]
mov dword [ebp - 0x11f4], eax
call fcn.0040aae0
lea ecx, [ebp - 0xb78]
mov dword [ebp - 0x1210], eax
call fcn.0040aae0
movq xmm0, qword [str.sfxinst]
mov dword [ebp - 0x1218], eax
mov eax, dword [0x52bd4c]
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xaec], 0x37434235
mov eax, dword [ebp - 0xaec]
mov dword [ebp - 0xb04], eax
lea eax, [ebp - 0x11f4]
push eax
lea eax, [ebp - 0x1210]
mov dword [ebp - 0xae8], 0x37314446
mov ecx, dword [ebp - 0xae8]
push eax
lea eax, [ebp - 0x1218]
mov dword [ebp - 0xb00], ecx
push eax
lea ecx, [ebp - 0xb10]
movq qword [ebp - 0xb10], xmm0
mov dword [ebp - 0xafc], 0x19
call fcn.00421390
add esp, 0xc
lea ecx, [ebp - 0x1250]
call fcn.0040aa40
lea ecx, [ebp - 0xc78]
call fcn.0040aa40
lea ecx, [ebp - 0xbc0]
call fcn.0040aa40
lea ecx, [ebp - 0xb78]
mov byte [ebp - 4], 0x32
call fcn.0040aa40
add esi, 0x18
mov dword [ebp - 0x11f4], esi
cmp esi, dword [ebp - 0x1204]
jne 0x41c9d0
lea ecx, [ebp - 0xb84]
mov byte [ebp - 4], 0x2c
call fcn.0040b810
jmp 0x41ce8f
lea ecx, [ebp - 0xcf4]
call fcn.0040aae0
movq xmm0, qword [str.sfxinst]
mov dword [ebp - 0x1204], eax
mov eax, dword [0x52bd4c]
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xaec], 0x37434235
mov eax, dword [ebp - 0xaec]
mov dword [ebp - 0xb04], eax
lea eax, [ebp - 0x1204]
mov dword [ebp - 0xae8], 0x37314446
mov ecx, dword [ebp - 0xae8]
mov dword [ebp - 0xb00], ecx
lea ecx, [ebp - 0xb10]
push eax
movq qword [ebp - 0xb10], xmm0
mov dword [ebp - 0xafc], 0x19
call fcn.004213b0
add esp, 4
cmp dword [ebp - 0xb1c], 8
lea edi, [ebp - 0xb30]
mov ecx, dword [ebp - 0xeb4]
cmovae edi, dword [ebp - 0xb30]
test ecx, ecx
je 0x41cf3c
mov edx, dword [ebp - 0xeb0]
test edx, edx
je 0x41cf3c
mov eax, dword [ebp - 0xf38]
sub ecx, edx
push 0
push ecx
mov esi, dword [eax + 0x14]
mov ecx, esi
call dword [0x4f933c]
lea ecx, [ebp - 0xf38]
call esi
test eax, eax
js 0x41cf3c
mov eax, dword [ebp - 0xf38]
push dword [ebp - 0xeb0]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x4f933c]
lea ecx, [ebp - 0xf38]
call esi
mov dword [ebp - 0x1204], eax
test eax, eax
je 0x41cf3c
push edi
push dword [ebp - 0xeb0]
push eax
call fcn.00411150
mov ecx, dword [ebp - 0xf38]
mov edi, eax
push dword [ebp - 0x1204]
mov esi, dword [ecx + 0x10]
mov ecx, esi
call dword [0x4f933c]
lea ecx, [ebp - 0xf38]
call esi
test edi, edi
je 0x41cf53
lea ecx, [ebp - 0xb30]
call fcn.0040aae0
push eax
lea ecx, [ebp - 0xf50]
call fcn.00410b20
cmp dword [ebp - 0xb1c], 8
lea edx, [ebp - 0xb30]
mov ecx, dword [ebp - 0xb20]
cmovae edx, dword [ebp - 0xb30]
sub esp, 8
mov eax, esp
push ecx
push edx
lea ecx, [ebp - 0xb60]
mov dword [eax], str.cookie.bin
mov dword [eax + 4], 0xa
call fcn.0048b850
add esp, 0x10
cmp dword [ebp - 0xc38], 0
jne 0x41d06d
lea ecx, [ebp - 0xb60]
call fcn.0048afe0
test al, al
je 0x41d06d
xorps xmm0, xmm0
mov dword [ebp - 0xae4], 0
lea edx, [ebp - 0xb60]
movq qword [ebp - 0xaec], xmm0
lea ecx, [ebp - 0xaec]
call fcn.004213d0
mov byte [ebp - 4], 0x37
mov ecx, dword [ebp - 0xae8]
mov eax, dword [ebp - 0xaec]
sub ecx, eax
push ecx
push eax
lea ecx, [ebp - 0xb48]
call fcn.004134b0
push 0xfde9
mov edx, eax
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x1250]
call fcn.004214a0
add esp, 4
lea ecx, [ebp - 0xc48]
push eax
call fcn.0040d690
lea ecx, [ebp - 0x1250]
call fcn.0040aa40
lea ecx, [ebp - 0xb48]
mov byte [ebp - 4], 0x37
call fcn.004135f0
lea eax, [ebp - 0xc48]
push eax
sub esp, 0xc
mov ecx, esp
push 0x52a100
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00420140
add esp, 4
mov ecx, eax
call fcn.0040d640
lea ecx, [ebp - 0xaec]
mov byte [ebp - 4], 0x2c
call fcn.0040b430
sub esp, 0x18
lea eax, [ebp - 0xc48]
mov ecx, esp
push eax
call fcn.0040d770
lea eax, [ebp - 0xc18]
push 0x554e00
push eax
lea edx, [ebp - 0xa0]
lea ecx, [ebp - 0x1250]
call fcn.00414540
add esp, 0x20
lea ecx, [ebp - 0x1250]
call fcn.0040aa40
xor edi, edi
nop dword [eax + eax]
cmp dword [ebp - 0xb1c], 8
lea edx, [ebp - 0xb30]
mov ecx, dword [edi + 0x54db80]
cmovae edx, dword [ebp - 0xb30]
sub esp, 8
mov eax, dword [ebp - 0xb20]
mov esi, esp
mov dword [ebp - 0x11f4], eax
lea eax, [ecx + 2]
mov dword [ebp - 0x1204], eax
mov dword [esi], ecx
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d0e6
sub ecx, dword [ebp - 0x1204]
push dword [ebp - 0x11f4]
sar ecx, 1
mov dword [esi + 4], ecx
lea ecx, [ebp - 0xb60]
push edx
call fcn.0048b850
add esp, 0x10
lea eax, [ebp - 0xb60]
cmp dword [ebp - 0xb4c], 8
cmovae eax, dword [ebp - 0xb60]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41d1eb
test al, 0x10
jne 0x41d1eb
mov ecx, dword [edi + 0x54db84]
mov esi, ecx
mov dword [ebp - 0x1204], ecx
lea edx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x41d150
sub esi, edx
sar esi, 1
push esi
push ecx
lea ecx, [ebp - 0xc18]
call fcn.004156a0
mov ecx, eax
test ecx, ecx
jne 0x41d1c7
sub esp, 0x18
xorps xmm0, xmm0
mov eax, esp
mov dword [ebp - 0x11f8], esp
movups xmmword [eax], xmm0
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], 7
mov word [eax], cx
sub esp, 0x18
mov byte [ebp - 4], 0x39
mov ecx, esp
push esi
push dword [ebp - 0x1204]
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0040a960
lea ecx, [ebp - 0xc18]
mov byte [ebp - 4], 0x2c
call fcn.004203c0
mov ecx, eax
lea eax, [ebp - 0xb60]
cmp ecx, eax
je 0x41d1eb
cmp dword [ebp - 0xb4c], 8
push dword [ebp - 0xb50]
cmovae eax, dword [ebp - 0xb60]
push eax
call fcn.0040a680
add edi, 8
cmp edi, 0x18
jb 0x41d0b0
cmp dword [ebp - 0xb1c], 8
lea edx, [ebp - 0xb30]
mov ecx, dword [ebp - 0xb20]
cmovae edx, dword [ebp - 0xb30]
sub esp, 8
mov eax, esp
push ecx
push edx
lea ecx, [ebp - 0xb60]
mov dword [eax], str.aswOfferTool.exe
mov dword [eax + 4], 0x11
call fcn.0048b850
cmp dword [ebp - 0xb4c], 8
lea edx, [ebp - 0xb60]
cmovae edx, dword [ebp - 0xb60]
add esp, 0xc
push 0x7d1
call fcn.0040aeb0
cmp dword [ebp - 0xb1c], 8
lea edx, [ebp - 0xb30]
mov ecx, dword [ebp - 0xb20]
mov eax, esp
cmovae edx, dword [ebp - 0xb30]
push ecx
push edx
lea ecx, [ebp - 0xb60]
mov dword [eax], str.GuiCust.dll
mov dword [eax + 4], 0xb
call fcn.0048b850
cmp dword [ebp - 0xb4c], 8
lea edx, [ebp - 0xb60]
cmovae edx, dword [ebp - 0xb60]
add esp, 0xc
push 0x7d0
call fcn.0040aeb0
cmp dword [ebp - 0xb1c], 8
lea edx, [ebp - 0xb30]
mov edi, dword [ebp - 0xb20]
mov ecx, 0x529858
cmovae edx, dword [ebp - 0xb30]
mov esi, esp
lea eax, [ecx + 2]
mov dword [esi], 0x529858
mov dword [ebp - 0x1204], eax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d2e0
sub ecx, dword [ebp - 0x1204]
sar ecx, 1
mov dword [esi + 4], ecx
lea ecx, [ebp - 0xb60]
push edi
push edx
call fcn.0048b850
cmp dword [ebp - 0xb4c], 8
lea edx, [ebp - 0xb60]
cmovae edx, dword [ebp - 0xb60]
add esp, 0xc
push 0x7d2
call fcn.0040aeb0
add esp, 8
push 0x5c
lea eax, [ebp - 0xe30]
push 0
push eax
call fcn.004b23a0
sub esp, 0xc
mov eax, 0x7ffffffe
mov ecx, esp
mov dword [ebp - 0x11f8], ecx
mov edx, dword [ebp - 0xb20]
sub eax, edx
cmp eax, 0xc
jb 0x41f3a2
cmp dword [ebp - 0xb1c], 8
lea eax, [ebp - 0xb30]
push 0xc
cmovae eax, dword [ebp - 0xb30]
push str._servers.def
push edx
push eax
push ecx
push dword [ebp - 0x11f8]
call fcn.0040a3d0
mov eax, dword [ebp - 0x1200]
lea ecx, [ebp - 0xe30]
or eax, 0x200
mov dword [ebp - 0x1200], eax
mov dword [ebp - 0x1210], eax
call fcn.004190f0
sub esp, 0x18
mov byte [ebp - 4], 0x3a
lea eax, [ebp - 0xc48]
mov dword [ebp - 0x11f8], esp
mov ecx, esp
push eax
call fcn.0040d770
sub esp, 0x18
mov byte [ebp - 4], 0x3b
lea eax, [ebp - 0xc60]
mov dword [ebp - 0x1204], esp
mov ecx, esp
push eax
call fcn.0040d770
sub esp, 0x18
mov byte [ebp - 4], 0x3c
mov edx, esp
lea ecx, [ebp - 0xa0]
xorps xmm0, xmm0
lea esi, [ecx + 2]
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d400
sub ecx, esi
lea eax, [ebp - 0xa0]
sar ecx, 1
push ecx
push eax
mov ecx, edx
call fcn.0040a960
lea eax, [ebp - 0xc18]
mov byte [ebp - 4], 0x3a
push eax
lea ecx, [ebp - 0xe30]
call fcn.004249d0
sub esp, 0x18
xorps xmm0, xmm0
mov ecx, esp
push 4
movups xmmword [ecx], xmm0
push str.stub
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0040a960
lea ecx, [ebp - 0xe30]
call fcn.00424dc0
mov ecx, 0x554e00
mov byte [ebp - 4], 0x3d
xorps xmm0, xmm0
mov dword [ebp - 0xb80], 0
movups xmmword [ebp - 0xb90], xmm0
mov dword [ebp - 0xb7c], 0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d490
sub ecx, edx
sar ecx, 1
push ecx
push 0x554e00
lea ecx, [ebp - 0xb90]
call fcn.0040a960
lea edx, [ebp - 0xb90]
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0xb18]
call fcn.0048c6d0
xorps xmm0, xmm0
mov dword [ebp - 0xd14], 0
movq qword [ebp - 0xd1c], xmm0
mov byte [ebp - 0xcf8], 0
mov al, byte [ebp - 0x1219]
lea esi, [ebp - 0xa0]
mov ecx, esi
mov byte [ebp - 4], 0x3f
mov byte [ebp - 0xd28], al
mov eax, dword [ebp - 0x1234]
mov dword [ebp - 0xd1c], eax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41d510
mov eax, dword [ebp - 0x1208]
sub ecx, edx
mov dx, word [ebp - 0xb16]
mov di, word [ebp - 0xb14]
movzx eax, ax
mov dword [ebp - 0xd14], eax
mov ax, word [ebp - 0xb18]
sar ecx, 1
mov dword [ebp - 0xd24], esi
mov dword [ebp - 0xd20], ecx
test ax, ax
jne 0x41d567
test dx, dx
jne 0x41d567
test di, di
jne 0x41d567
cmp word [ebp - 0xb12], di
je 0x41d584
movzx eax, al
shl ax, 8
movzx ecx, ax
movzx eax, dl
or ecx, eax
movzx eax, di
shl ecx, 0x10
or ecx, eax
mov dword [ebp - 0xd18], ecx
lea eax, [ebp - 0xc48]
push eax
lea ecx, [ebp - 0xd10]
call fcn.0040d770
xorps xmm0, xmm0
mov byte [ebp - 0xcf8], 1
push 0
lea ecx, [ebp - 0xb78]
movq qword [ebp - 0xb68], xmm0
movups xmmword [ebp - 0xb78], xmm0
call fcn.0049a820
push 7
lea ecx, [ebp - 0x1250]
mov byte [ebp - 4], 0x40
call fcn.0049a820
push eax
lea ecx, [ebp - 0xb78]
call fcn.0049aca0
lea ecx, [ebp - 0x1250]
call fcn.0049ac20
lea eax, [ebp - 0xc60]
mov byte [ebp - 4], 0x41
push eax
push str.session_id
lea ecx, [ebp - 0xb78]
call fcn.00419db0
cmp dword [ebp - 0xb7c], 8
lea eax, [ebp - 0xb90]
mov esi, dword [ebp - 0xb80]
mov edx, esi
cmovae eax, dword [ebp - 0xb90]
push 2
push 0x52fdac
push ecx
mov ecx, eax
mov dword [ebp - 0x1208], eax
call fcn.0044f410
add esp, 0xc
cmp eax, 0xffffffff
je 0x41d659
lea edx, [eax + 1]
cmp esi, edx
jb 0x41f3a7
mov eax, dword [ebp - 0x1208]
sub esi, edx
or ecx, 0xffffffff
cmp esi, 0xffffffff
cmovb ecx, esi
lea eax, [eax + edx*2]
jmp 0x41d661
mov eax, dword [ebp - 0x1208]
mov ecx, esi
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0xb00], 0
push eax
lea ecx, [ebp - 0xb10]
mov dword [ebp - 0xafc], 0
movups xmmword [ebp - 0xb10], xmm0
call fcn.0040a960
mov eax, dword [ebp - 0x1200]
or eax, 0x400
mov dword [ebp - 0x1200], eax
mov dword [ebp - 0x1210], eax
lea eax, [ebp - 0xb10]
mov byte [ebp - 4], 0x42
push eax
push str.sfx_name
lea ecx, [ebp - 0xb78]
call fcn.00419db0
lea ecx, [ebp - 0xb10]
call fcn.0040aa40
cmp word [ebp - 0xb18], 0
mov ax, word [ebp - 0xb16]
jne 0x41d6f1
test ax, ax
jne 0x41d6f1
test di, di
jne 0x41d6f1
cmp word [ebp - 0xb12], di
jne 0x41d6f1
xor cl, cl
jmp 0x41d6f3
mov cl, 1
test cl, cl
je 0x41d780
xorps xmm0, xmm0
mov dword [ebp - 0xb98], 0
xor ecx, ecx
mov dword [ebp - 0xb94], 7
movups xmmword [ebp - 0xba8], xmm0
mov word [ebp - 0xba8], cx
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0xba8]
movzx esi, word [ebp - 0xb12]
push esi
movzx edx, di
push edx
mov dword [ebp - 0x1204], ecx
movzx ecx, ax
movzx eax, word [ebp - 0xb18]
push ecx
push eax
lea eax, [ebp - 0x1204]
push 0x52a3b8
push eax
call fcn.0040d3f0
add esp, 0x18
lea eax, [ebp - 0xba8]
lea ecx, [ebp - 0xb78]
push eax
push str.sfx_version
call fcn.00419db0
lea ecx, [ebp - 0xba8]
call fcn.0040aa40
cmp dword [ebp - 0xb7c], 8
lea eax, [ebp - 0xb90]
push 0
cmovae eax, dword [ebp - 0xb90]
push 0
push 3
push 0
push 7
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0xb14], esi
mov byte [ebp - 4], 0x44
cmp esi, 0xffffffff
je 0x41d8c5
push 0
push 0
lea eax, [ebp - 0xae0]
mov dword [ebp - 0xae0], 0
push eax
push esi
mov dword [ebp - 0xadc], 0
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x41d8c5
mov eax, dword [ebp - 0xae0]
mov edx, 0xe57a42bd
mul edx
mov ecx, 0xd6bf94d5
mov dword [ebp - 0xad8], eax
mov edi, edx
mov eax, dword [ebp - 0xae0]
mul ecx
mov ecx, 0xe57a42bd
mov dword [ebp - 0x1208], eax
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0x11f4], edx
mul ecx
mov ecx, eax
mov dword [ebp - 0x1204], edx
mov eax, dword [ebp - 0xadc]
mov edx, 0xd6bf94d5
mul edx
add ecx, edi
mov dword [ebp - 0x1218], eax
mov eax, dword [ebp - 0x1208]
mov edi, dword [ebp - 0x1218]
mov dword [ebp - 0x11f8], edx
mov edx, dword [ebp - 0x1204]
adc edx, 0
add eax, ecx
mov ecx, dword [ebp - 0x11f4]
adc ecx, 0
mov dword [ebp - 0xad8], eax
xor eax, eax
add edx, ecx
mov ecx, dword [ebp - 0x11f8]
adc eax, eax
add edi, edx
adc ecx, eax
shrd edi, ecx, 0x17
shr ecx, 0x17
sub edi, 0xb6109100
sbb ecx, 2
push ecx
push edi
lea ecx, [ebp - 0x1250]
call fcn.00422ef0
add esp, 8
push eax
push str.sfx_created
lea ecx, [ebp - 0xb78]
mov byte [ebp - 4], 0x45
call fcn.00419db0
lea ecx, [ebp - 0x1250]
mov byte [ebp - 4], 0x44
call fcn.0040aa40
xorps xmm0, xmm0
lea ecx, [ebp - 0xbc0]
push 0
movups xmmword [ebp - 0xbc0], xmm0
movq qword [ebp - 0xbb0], xmm0
call fcn.0049a820
push 7
lea ecx, [ebp - 0x1250]
mov byte [ebp - 4], 0x46
call fcn.0049a820
push eax
lea ecx, [ebp - 0xbc0]
call fcn.0049aca0
lea ecx, [ebp - 0x1250]
call fcn.0049ac20
push str.instup
lea ecx, [ebp - 0xbc0]
mov byte [ebp - 4], 0x47
call fcn.0049af40
lea ecx, [ebp - 0xb78]
push ecx
mov ecx, eax
call fcn.0049ad00
push 0x5c
lea eax, [ebp - 0xfb0]
push 0
push eax
call fcn.004b23a0
add esp, 0xc
call fcn.00450a60
dec eax
cmp eax, 5
ja case.0x41d950.3
jmp dword [eax*4 + 0x41f3d8]
mov edi, 1
jmp 0x41d971
mov edi, 0x40
jmp 0x41d971
mov edi, 0x258
jmp 0x41d971
mov edi, 0x1f4
sub esp, 0x34
mov edx, esp
mov dword [ebp - 0x11f8], edx
mov al, byte [ebp - 0xd28]
mov byte [edx], al
mov eax, dword [ebp - 0xd24]
mov ecx, dword [ebp - 0xd20]
mov dword [edx + 4], eax
mov dword [edx + 8], ecx
mov eax, dword [ebp - 0xd1c]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xd18]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0xd14]
mov dword [edx + 0x14], eax
lea eax, [edx + 0x18]
mov dword [ebp - 0x11f8], eax
mov byte [eax + 0x18], 0
mov byte [ebp - 4], 0x48
cmp byte [ebp - 0xcf8], 0
je 0x41d9e3
lea ecx, [ebp - 0xd10]
push ecx
mov ecx, eax
call fcn.0040d770
mov eax, dword [ebp - 0x11f8]
mov byte [eax + 0x18], 1
push edi
lea ecx, [ebp - 0xfb0]
mov byte [ebp - 4], 0x47
call fcn.00419f70
lea eax, [ebp - 0xbc0]
mov byte [ebp - 4], 0x49
push eax
push ecx
lea ecx, [ebp - 0xfb0]
call fcn.00426870
lea ecx, [ebp - 0xf6c]
call fcn.0040aa40
cmp byte [ebp - 0xf70], 0
je 0x41da29
lea ecx, [ebp - 0xf88]
call fcn.0040aa40
mov eax, dword [ebp - 0xfa8]
test eax, eax
je 0x41da49
mov eax, dword [eax]
push 1
mov edi, dword [eax]
mov ecx, edi
call dword [0x4f933c]
mov ecx, dword [ebp - 0xfa8]
call edi
lea ecx, [ebp - 0xbc0]
call fcn.0049ac20
cmp esi, 0xffffffff
je 0x41da60
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xb78]
call fcn.0049ac20
cmp byte [ebp - 0xcf8], 0
je 0x41da7f
lea ecx, [ebp - 0xd10]
call fcn.0040aa40
lea ecx, [ebp - 0xb90]
call fcn.0040aa40
mov dword [ebp - 4], 0x3a
mov edi, dword [ebp - 0x1200]
jmp 0x41db72
cmp dword [ebp - 0xb1c], 8
lea eax, [ebp - 0xb30]
lea ecx, [ebp - 0xd9c]
cmovae eax, dword [ebp - 0xb30]
sub esp, 8
push ecx
push eax
lea ecx, [ebp - 0xf50]
call fcn.00411a80
mov esi, eax
mov dword [ebp - 0x1218], esi
test esi, esi
je 0x41dd96
cmp byte [ebp - 0x122c], 0
jne 0x41dbff
cmp dword [ebp - 0xb1c], 8
lea eax, [ebp - 0xb30]
push esi
cmovae eax, dword [ebp - 0xb30]
push eax
push str.The_installer_cannot_extract_VPX_files_to__s__code_0x_x_
lea eax, [ebp - 0xac8]
push 0x410
push eax
call fcn.00413490
add esp, 0x14
call fcn.0041a340
push 0x10
push eax
lea eax, [ebp - 0xac8]
push eax
push dword [ebp - 0xfc0]
call dword [sym.imp.USER32.dll_MessageBoxW]
movq xmm0, qword [str.sfxinst]
lea edi, [ebp - 0xb30]
mov eax, dword [0x52bd4c]
cmp dword [ebp - 0xb1c], 8
mov dword [ebp - 0xae8], 0x37314446
mov ecx, dword [ebp - 0xae8]
cmovae edi, dword [ebp - 0xb30]
movq qword [ebp - 0xb10], xmm0
xorps xmm0, xmm0
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xb00], ecx
lea ecx, [ebp - 0xae0]
mov dword [ebp - 0xaec], 0x37434235
mov eax, dword [ebp - 0xaec]
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xafc], 0x19
movlpd qword [ebp - 0xae0], xmm0
call fcn.0040add0
mov byte [ebp - 4], 0x4b
mov ecx, dword [ebp - 0xae0]
test ecx, ecx
je 0x41dc9d
push esi
push edi
push str.Cannot_extract_VPX_files_to__s__code_0x_x_
lea eax, [ebp - 0xb10]
push eax
push 7
call fcn.00413300
mov ecx, dword [ebp - 0xadc]
or edi, 0xffffffff
mov dword [ebp - 0x1208], ecx
test ecx, ecx
je 0x41dcf7
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x41dcf7
mov eax, dword [ecx]
mov esi, dword [eax]
mov ecx, esi
call dword [0x4f933c]
mov ecx, dword [ebp - 0x1208]
call esi
mov ecx, dword [ebp - 0x1208]
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x41dcf1
mov eax, dword [ecx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4f933c]
mov ecx, dword [ebp - 0x1208]
call esi
mov esi, dword [ebp - 0x1218]
mov byte [ebp - 4], 0x4c
mov ecx, dword [ebp - 0xddc]
mov eax, dword [ebp - 0xde0]
mov dword [ebp - 0x1204], ecx
cmp eax, ecx
je 0x41dd2b
mov esi, eax
mov ecx, esi
call fcn.00423010
add esi, 8
cmp esi, dword [ebp - 0x1204]
jne 0x41dd13
mov esi, dword [ebp - 0x1218]
lea ecx, [ebp - 0xde0]
call fcn.00420210
lea eax, [ebp - 0xe10]
push eax
call fcn.004ad83a
mov eax, dword [ebp - 0xe18]
add esp, 4
push dword [eax + 4]
lea eax, [ebp - 0xe18]
push eax
mov ecx, eax
call fcn.004161a0
push 0x40
push dword [ebp - 0xe18]
call fcn.004af3e3
add esp, 8
lea ecx, [ebp - 0xe30]
call fcn.0040aa40
lea ecx, [ebp - 0x1008]
call fcn.004179c0
lea ecx, [ebp - 0xcac]
mov byte [ebp - 4], 0x14
call fcn.0040aa40
jmp 0x41baa9
cmp byte [ebp - 0x1236], 0
je 0x41df88
push 0x4a
xorps xmm0, xmm0
mov dword [ebp - 0x1294], 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea ecx, [ebp - 0x12a4]
mov dword [ebp - 0x1290], 0
movups xmmword [ebp - 0x12a4], xmm0
call fcn.0040a960
mov ecx, str.instup.exe
mov byte [ebp - 4], 0x4d
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41dde0
sub ecx, edx
sar ecx, 1
push ecx
push str.instup.exe
lea ecx, [ebp - 0x12a4]
call fcn.0040a5c0
mov dword [ebp - 0xbb0], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0xbc0], xmm0
mov dword [ebp - 0xbac], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
or edi, 0x1000
movups xmmword [ebp - 0xbc0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xbb0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x4e
lea edx, [ebp - 0xbc0]
cmp dword [ebp - 0xbac], 8
mov ecx, 0x80000002
push 0x200
cmovae edx, dword [ebp - 0xbc0]
call fcn.0048eeb0
add esp, 4
lea ecx, [ebp - 0xbc0]
call fcn.0040aa40
lea ecx, [ebp - 0x12a4]
mov byte [ebp - 4], 0x3a
call fcn.0040aa40
push 0x4a
xorps xmm0, xmm0
mov dword [ebp - 0x12ac], 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea ecx, [ebp - 0x12bc]
mov dword [ebp - 0x12a8], 0
movups xmmword [ebp - 0x12bc], xmm0
call fcn.0040a960
mov ecx, str.instup.exe
mov byte [ebp - 4], 0x4f
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41ded0
sub ecx, edx
sar ecx, 1
push ecx
push str.instup.exe
lea ecx, [ebp - 0x12bc]
call fcn.0040a5c0
mov dword [ebp - 0x1264], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x1274], xmm0
mov dword [ebp - 0x1260], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
or edi, 0x800
movups xmmword [ebp - 0x1274], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1264], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov dword [ebp - 0x1200], edi
mov byte [ebp - 4], 0x50
lea edx, [ebp - 0x1274]
cmp dword [ebp - 0x1260], 8
mov ecx, 0x80000002
push 0x100
cmovae edx, dword [ebp - 0x1274]
call fcn.0048eeb0
add esp, 4
lea ecx, [ebp - 0x1274]
call fcn.0040aa40
lea ecx, [ebp - 0x12bc]
mov byte [ebp - 4], 0x3a
call fcn.0040aa40
cmp dword [ebp - 0xb1c], 8
lea edx, [ebp - 0xb30]
mov eax, dword [ebp - 0xb20]
mov ecx, str.instup.exe
cmovae edx, dword [ebp - 0xb30]
sub esp, 8
mov edi, esp
mov dword [ebp - 0x1204], eax
lea eax, [ecx + 2]
mov dword [ebp - 0x11f8], eax
mov dword [edi], str.instup.exe
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41dfc1
sub ecx, dword [ebp - 0x11f8]
push dword [ebp - 0x1204]
sar ecx, 1
mov dword [edi + 4], ecx
lea ecx, [ebp - 0xbd8]
push edx
call fcn.0048b850
add esp, 0x10
cmp byte [ebp - 0x11f9], 0
je 0x41ea04
cmp byte [ebp - 0x1228], 0
jne 0x41e024
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x1234]
mov edx, eax
call fcn.004198c0
push 1
movzx ecx, al
push edx
push ecx
call fcn.00419630
add esp, 0xc
xorps xmm0, xmm0
mov dword [ebp - 0xae8], 0
xor eax, eax
mov dword [ebp - 0xae4], 7
movups xmmword [ebp - 0xaf8], xmm0
mov word [ebp - 0xaf8], ax
push 0x40aaa0
push fcn.0040a7c0
push 2
push 0x18
lea eax, [ebp - 0xdcc]
mov byte [ebp - 4], 0x51
push eax
call fcn.004afaa1
xorps xmm0, xmm0
mov dword [ebp - 0xb68], 0
xor eax, eax
mov dword [ebp - 0xb64], 7
movups xmmword [ebp - 0xb78], xmm0
mov word [ebp - 0xb78], ax
mov byte [ebp - 4], 0x53
lea edx, [ebp - 0xb30]
cmp dword [ebp - 0xb1c], 8
mov ecx, str.instup.exe
mov eax, dword [ebp - 0xb20]
cmovae edx, dword [ebp - 0xb30]
sub esp, 8
mov edi, esp
mov dword [ebp - 0x1204], eax
lea eax, [ecx + 2]
mov dword [ebp - 0x11f8], eax
mov dword [edi], str.instup.exe
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41e0d0
sub ecx, dword [ebp - 0x11f8]
push dword [ebp - 0x1204]
sar ecx, 1
mov dword [edi + 4], ecx
lea ecx, [ebp - 0xdcc]
push edx
call fcn.0048b850
cmp dword [ebp - 0xb1c], 8
lea edx, [ebp - 0xb30]
mov eax, dword [ebp - 0xb20]
mov ecx, str.Instup.dll
cmovae edx, dword [ebp - 0xb30]
add esp, 8
mov edi, esp
mov dword [ebp - 0x1204], eax
lea eax, [ecx + 2]
mov dword [ebp - 0x11f8], eax
mov dword [edi], str.Instup.dll
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41e131
sub ecx, dword [ebp - 0x11f8]
push dword [ebp - 0x1204]
sar ecx, 1
mov dword [edi + 4], ecx
lea ecx, [ebp - 0xdb4]
push edx
call fcn.0048b850
cmp dword [ebp - 0xc1c], 8
lea edx, [ebp - 0xc30]
mov eax, dword [ebp - 0xc20]
mov ecx, str.instup.exe
cmovae edx, dword [ebp - 0xc30]
add esp, 8
mov edi, esp
mov dword [ebp - 0x1204], eax
lea eax, [ecx + 2]
mov dword [ebp - 0x11f8], eax
mov dword [edi], str.instup.exe
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41e192
sub ecx, dword [ebp - 0x11f8]
push dword [ebp - 0x1204]
sar ecx, 1
mov dword [edi + 4], ecx
lea ecx, [ebp - 0xaf8]
push edx
call fcn.0048b850
add esp, 0x10
lea eax, [ebp - 0xaf8]
cmp dword [ebp - 0xae4], 8
cmovae eax, dword [ebp - 0xaf8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41e3aa
test al, 0x10
jne 0x41e3aa
cmp dword [ebp - 0x1230], 0x7cb
jbe 0x41e3aa
lea eax, [ebp - 0xdcc]
xor edi, edi
mov dword [ebp - 0x1208], eax
test esi, esi
jne 0x41e9c2
cmp dword [ebp - 0x1224], esi
jne 0x41e9c2
push 0x34
lea eax, [ebp - 0xf88]
push esi
push eax
call fcn.004b23a0
add esp, 0xc
lea ecx, [ebp - 0xf88]
call fcn.0041f3f0
mov byte [ebp - 4], 0x54
push dword [ebp - 0x1208]
sub esp, 0xc
mov ecx, esp
push str.copy_sfx
call fcn.00412540
lea ecx, [ebp - 0xf88]
call fcn.00420140
add esp, 4
mov ecx, eax
call fcn.0040d640
push 0x528d18
sub esp, 0xc
mov ecx, esp
push str.wait
call fcn.00412540
lea ecx, [ebp - 0xf88]
call fcn.00420140
add esp, 4
mov ecx, eax
call fcn.0040a790
sub esp, 8
lea eax, [ebp - 0x1250]
lea ecx, [ebp - 0xf88]
push eax
call fcn.0041fa30
mov ecx, eax
mov byte [ebp - 4], 0x55
call fcn.0040aae0
lea ecx, [ebp - 0xaf8]
mov esi, eax
call fcn.0040aae0
push 0
lea ecx, [ebp - 0x1224]
mov edx, esi
push 0
push ecx
mov ecx, eax
call fcn.00413be0
add esp, 0xc
lea ecx, [ebp - 0x1250]
mov esi, eax
call fcn.0040aa40
lea ecx, [ebp - 0xf88]
mov byte [ebp - 4], 0x53
call fcn.0041f650
add dword [ebp - 0x1208], 0x18
inc edi
cmp edi, 2
jb 0x41e207
test esi, esi
jne 0x41e9c2
cmp dword [ebp - 0x1224], esi
jne 0x41e9c2
lea eax, [ebp - 0xad4]
push eax
lea ecx, [ebp - 0xc30]
call fcn.0040b5d0
sub esp, 8
mov ecx, esp
mov edi, dword [eax]
mov esi, dword [eax + 4]
push 0x52a194
call fcn.00412540
push esi
push edi
lea ecx, [ebp - 0xb78]
call fcn.0048b850
add esp, 0x10
lea eax, [ebp - 0xad4]
lea ecx, [ebp - 0xb78]
push eax
call fcn.0040b5d0
sub esp, 8
mov ecx, esp
mov edi, dword [eax]
mov esi, dword [eax + 4]
push str.instup.exe
call fcn.00412540
push esi
push edi
lea ecx, [ebp - 0xb78]
call fcn.0048b850
add esp, 0x10
lea ecx, [ebp - 0xb78]
call fcn.0048afe0
test al, al
je 0x41e9c2
lea eax, [ebp - 0xb78]
push eax
lea ecx, [ebp - 0xbd8]
call fcn.0040d640
jmp 0x41e9c2
cmp dword [ebp - 0xc1c], 8
lea edx, [ebp - 0xc30]
mov ecx, dword [ebp - 0xc20]
cmovae edx, dword [ebp - 0xc30]
sub esp, 8
mov eax, esp
push ecx
push edx
lea ecx, [ebp - 0xaf8]
mov dword [eax], str.setup.ovr
mov dword [eax + 4], 9
call fcn.0048b850
add esp, 0x10
lea eax, [ebp - 0xaf8]
cmp dword [ebp - 0xae4], 8
cmovae eax, dword [ebp - 0xaf8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41e9c2
test al, 0x10
jne 0x41e9c2
nop dword [eax]
nop word [eax + eax]
xorps xmm0, xmm0
mov dword [ebp - 0xc84], 0
xor eax, eax
mov dword [ebp - 0xc80], 7
movups xmmword [ebp - 0xc94], xmm0
mov word [ebp - 0xc94], ax
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0xb48]
push 8
push str._copysfx
movups xmmword [ebp - 0xb48], xmm0
mov dword [ebp - 0xb38], eax
mov dword [ebp - 0xb34], eax
call fcn.0040a960
push 2
push 0x52b93c
lea ecx, [ebp - 0xb48]
mov byte [ebp - 4], 0x57
call fcn.0040a5c0
mov dword [ebp - 0xb00], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0xb10], xmm0
mov dword [ebp - 0xafc], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xb10], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xb00], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
or dword [ebp - 0x1200], 0x40
mov byte [ebp - 4], 0x58
lea eax, [ebp - 0xdcc]
cmp dword [ebp - 0xdb8], 8
lea ecx, [ebp - 0xb10]
push dword [ebp - 0xdbc]
cmovae eax, dword [ebp - 0xdcc]
push eax
call fcn.0040a5c0
mov dword [ebp - 0xc68], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0xc78], xmm0
mov dword [ebp - 0xc64], 0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xc78], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xc68], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
or dword [ebp - 0x1200], 0x80
push 1
push 0x52a3b4
lea ecx, [ebp - 0xc78]
mov byte [ebp - 4], 0x59
call fcn.0040a5c0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xb88], xmm0
movups xmmword [ebp - 0x128c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xae0], xmm0
movq qword [ebp - 0x127c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
lea ecx, [ebp - 0xc94]
or dword [ebp - 0x1200], 0x100
call fcn.0040aa40
movups xmm0, xmmword [ebp - 0xb88]
mov dword [ebp - 0x127c], 0
mov dword [ebp - 0x1278], 7
movups xmmword [ebp - 0xc94], xmm0
movq xmm0, qword [ebp - 0xae0]
movq qword [ebp - 0xc84], xmm0
xor eax, eax
lea ecx, [ebp - 0x128c]
mov word [ebp - 0x128c], ax
call fcn.0040aa40
lea ecx, [ebp - 0xc78]
call fcn.0040aa40
lea ecx, [ebp - 0xb10]
call fcn.0040aa40
lea ecx, [ebp - 0xb48]
mov byte [ebp - 4], 0x56
call fcn.0040aa40
cmp dword [ebp - 0xc80], 8
lea edx, [ebp - 0xc94]
push 0
cmovae edx, dword [ebp - 0xc94]
lea eax, [ebp - 0x1224]
cmp dword [ebp - 0xae4], 8
lea ecx, [ebp - 0xaf8]
push 0
cmovae ecx, dword [ebp - 0xaf8]
push eax
call fcn.00413be0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x41e6bb
mov ecx, dword [ebp - 0x1224]
cmp ecx, 0x2000000a
jne 0x41e694
push 0xbb8
mov dword [ebp - 0x1224], 0xa004
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0xc94]
call fcn.0040aa40
jmp 0x41e420
cmp ecx, 0x20000000
je 0x41e6b1
cmp ecx, 0x20000001
je 0x41e6b1
mov esi, 5
mov dword [ebp - 0x1224], esi
jmp 0x41e6c1
xor esi, esi
mov dword [ebp - 0x1224], esi
jmp 0x41e6c1
mov esi, dword [ebp - 0x1224]
lea ecx, [ebp - 0xc94]
mov byte [ebp - 4], 0x53
call fcn.0040aa40
test edi, edi
jne 0x41e9c2
test esi, esi
jne 0x41e9c2
cmp dword [ebp - 0xc1c], 8
lea edx, [ebp - 0xc30]
mov ecx, dword [ebp - 0xc20]
cmovae edx, dword [ebp - 0xc30]
sub esp, 8
mov eax, esp
push ecx
push edx
lea ecx, [ebp - 0xb60]
mov dword [eax], 0x52b958
mov dword [eax + 4], 3
call fcn.0048b850
cmp dword [ebp - 0xb4c], 8
lea edx, [ebp - 0xb60]
mov ecx, dword [ebp - 0xb50]
cmovae edx, dword [ebp - 0xb60]
add esp, 8
mov eax, esp
push ecx
push edx
lea ecx, [ebp - 0xbd8]
mov dword [eax], str.avast.setup
mov dword [eax + 4], 0xb
call fcn.0048b850
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 0x11f8], eax
test eax, eax
je 0x41e9c2
xorps xmm0, xmm0
mov dword [ebp - 0xad0], esi
movq qword [ebp - 0xad8], xmm0
mov dword [ebp - 0xad8], esi
mov dword [ebp - 0xad4], esi
mov dword [ebp - 0xad0], esi
lea ecx, [ebp - 0xad8]
mov byte [ebp - 4], 0x5a
push ecx
mov ecx, eax
call fcn.004180f0
add esp, 4
test al, al
je 0x41e9ab
mov esi, dword [ebp - 0xad8]
cmp esi, dword [ebp - 0xad4]
je 0x41e9ab
mov eax, dword fs:[0x2c]
mov edi, dword [eax]
push esi
lea ecx, [ebp - 0xba8]
call fcn.0040d770
mov byte [ebp - 4], 0x5b
mov eax, dword [0x552d20]
cmp eax, dword [edi + 4]
jle 0x41e815
push 0x552d20
call fcn.004af77a
add esp, 4
cmp dword [0x552d20], 0xffffffff
jne 0x41e815
mov byte [ebp - 4], 0x5c
call fcn.004acef1
push 0x552d20
mov dword [0x552d1c], eax
mov byte [ebp - 4], 0x5b
call fcn.004af730
add esp, 4
cmp dword [ebp - 0xb94], 8
lea edx, [ebp - 0xba8]
mov ecx, dword [ebp - 0xb98]
cmovae edx, dword [ebp - 0xba8]
sub esp, 8
mov eax, esp
push ecx
push edx
mov edx, dword [0x552d1c]
mov ecx, 5
mov dword [eax], str.path
mov dword [eax + 4], 5
call fcn.00415980
add esp, 0x10
lea ecx, [ebp - 0xba8]
test eax, eax
je 0x41e87d
mov byte [ebp - 4], 0x5a
call fcn.0040aa40
add esi, 0x18
cmp esi, dword [ebp - 0xad4]
jne 0x41e7c3
jmp 0x41e9ab
mov eax, dword [ebp - 0xb98]
dec eax
push eax
call fcn.0040d670
cmp word [eax], 0x3b
je 0x41e8b8
push 0x52b984
mov edx, esi
lea ecx, [ebp - 0x1250]
call fcn.0040a2f0
add esp, 4
mov ecx, esi
push eax
call fcn.0040d690
lea ecx, [ebp - 0x1250]
call fcn.0040aa40
mov edx, dword [esi + 0x10]
mov eax, 0x7ffffffe
mov edi, dword [ebp - 0xb20]
sub eax, edx
cmp eax, edi
jb 0x41f3cd
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x41e8da
mov ecx, dword [esi]
cmp dword [ebp - 0xb1c], 8
lea eax, [ebp - 0xb30]
push edi
cmovae eax, dword [ebp - 0xb30]
push eax
push edx
push ecx
push ecx
push dword [ebp - 0xb14]
lea ecx, [ebp - 0x1250]
call fcn.0040a3d0
push 1
push 0x52b984
lea ecx, [ebp - 0x1250]
mov byte [ebp - 4], 0x5d
call fcn.0040a5c0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x128c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x127c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
lea eax, [ebp - 0x128c]
push eax
mov ecx, esi
call fcn.0040d690
lea ecx, [ebp - 0x128c]
call fcn.0040aa40
lea ecx, [ebp - 0x1250]
mov byte [ebp - 4], 0x5b
call fcn.0040aa40
lea edx, [ebp - 0xad8]
lea ecx, [ebp - 0xb84]
call fcn.00418290
push eax
lea ecx, [ebp - 0xbe4]
call fcn.00418460
lea ecx, [ebp - 0xb84]
call fcn.0040b430
lea ecx, [ebp - 0xba8]
call fcn.0040aa40
mov eax, dword [ebp - 0xbe4]
mov dword [ebp - 0x125c], eax
push dword [ebp - 0x11f8]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea ecx, [ebp - 0xad8]
call fcn.0040b810
lea ecx, [ebp - 0xb78]
call fcn.0040aa40
push 0x40aaa0
push 2
push 0x18
lea eax, [ebp - 0xdcc]
mov byte [ebp - 4], 0x51
push eax
call fcn.004afb15
lea ecx, [ebp - 0xaf8]
mov byte [ebp - 4], 0x3a
call fcn.0040aa40
cmp byte [ebp - 0x1228], 0
jne 0x41eae2
jmp 0x41ea3c
cmp byte [ebp - 0x1228], 0
jne 0x41eae2
lea eax, [ebp - 0xa0]
push eax
sub esp, 0xc
mov ecx, esp
push 0x52a05c
call fcn.00412540
lea ecx, [ebp - 0xc18]
call fcn.00420140
add esp, 4
mov ecx, eax
call fcn.0040a790
mov esi, str.ga_clientid
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x41ea44
sub esi, ecx
lea ecx, [ebp - 0xc18]
sar esi, 1
push esi
push str.ga_clientid
call fcn.004156a0
mov ecx, eax
test ecx, ecx
jne 0x41eabe
sub esp, 0x18
xorps xmm0, xmm0
mov eax, esp
mov dword [ebp - 0xb14], esp
movups xmmword [eax], xmm0
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], 7
mov word [eax], cx
sub esp, 0x18
mov byte [ebp - 4], 0x5e
mov ecx, esp
push esi
movups xmmword [ecx], xmm0
push str.ga_clientid
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.0040a960
lea ecx, [ebp - 0xc18]
mov byte [ebp - 4], 0x3a
call fcn.004203c0
mov ecx, eax
lea eax, [ebp - 0xc60]
cmp ecx, eax
je 0x41eae2
cmp dword [ebp - 0xc4c], 8
push dword [ebp - 0xc50]
cmovae eax, dword [ebp - 0xc60]
push eax
call fcn.0040a680
movq xmm0, qword [str.sfxinst]
lea esi, [ebp - 0xbd8]
mov eax, dword [0x52bd4c]
cmp dword [ebp - 0xbc4], 8
mov dword [ebp - 0xae8], 0x37314446
mov ecx, dword [ebp - 0xae8]
cmovae esi, dword [ebp - 0xbd8]
movq qword [ebp - 0xb48], xmm0
xorps xmm0, xmm0
mov dword [ebp - 0xb40], eax
mov dword [ebp - 0xb38], ecx
lea ecx, [ebp - 0xae0]
mov dword [ebp - 0xaec], 0x37434235
mov eax, dword [ebp - 0xaec]
mov dword [ebp - 0xb3c], eax
mov dword [ebp - 0xb34], 0x19
movlpd qword [ebp - 0xae0], xmm0
call fcn.0040add0
mov byte [ebp - 4], 0x5f
mov ecx, dword [ebp - 0xae0]
test ecx, ecx
je 0x41eb7f
push esi
push 0x52b988
lea eax, [ebp - 0xb48]
push eax
push 2
call fcn.0040cf40
mov byte [ebp - 4], 0x3a
or edi, 0xffffffff
mov ecx, dword [ebp - 0xadc]
mov dword [ebp - 0x1208], ecx
test ecx, ecx
je 0x41ebd7
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x41ebd7
mov eax, dword [ecx]
mov esi, dword [eax]
mov ecx, esi
call dword [0x4f933c]
mov ecx, dword [ebp - 0x1208]
call esi
mov ecx, dword [ebp - 0x1208]
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x41ebd7
mov eax, dword [ecx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4f933c]
mov ecx, dword [ebp - 0x1208]
call esi
sub esp, 8
lea eax, [ebp - 0xe78]
lea ecx, [ebp - 0xc18]
push eax
call fcn.0041fa30
mov byte [ebp - 4], 0x60
mov esi, dword [ebp - 0x1220]
test esi, esi
je 0x41ec4c
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41ec00
sub ecx, edx
sar ecx, 1
je 0x41ec4c
push 1
push 0x52b9e0
lea ecx, [ebp - 0xe78]
call fcn.0040a5c0
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41ec30
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0xe78]
call fcn.0040a5c0
mov eax, dword [ebp - 0x125c]
lea edx, [ebp - 0xe78]
xor ecx, ecx
mov esi, eax
cmp eax, dword [ebp - 0xbe0]
lea eax, [ebp - 0x1008]
cmove esi, ecx
cmp dword [ebp - 0xfc0], ecx
push esi
cmove eax, ecx
cmp dword [ebp - 0xe64], 8
push eax
cmovae edx, dword [ebp - 0xe78]
lea eax, [ebp - 0x1224]
cmp dword [ebp - 0xbc4], 8
lea ecx, [ebp - 0xbd8]
push eax
cmovae ecx, dword [ebp - 0xbd8]
call fcn.00413be0
mov esi, eax
add esp, 0xc
mov dword [ebp - 0x1218], esi
test esi, esi
je 0x41ef13
cmp byte [ebp - 0x122c], 0
jne 0x41ed69
cmp dword [ebp - 0xbc4], 8
lea eax, [ebp - 0xbd8]
push esi
cmovae eax, dword [ebp - 0xbd8]
push eax
push str.The_stub_cannot_run_installer_updater_executable__s__code_0x_x_
lea eax, [ebp - 0xac8]
push 0x410
push eax
call fcn.00413490
mov eax, dword fs:[0x2c]
add esp, 0x14
mov ecx, dword [eax]
mov eax, dword [0x555008]
cmp eax, dword [ecx + 4]
jle 0x41ed4e
push 0x555008
call fcn.004af77a
add esp, 4
cmp dword [0x555008], 0xffffffff
jne 0x41ed4e
mov byte [ebp - 4], 0x61
call fcn.00450a60
cmp eax, 1
mov byte [ebp - 4], 0x60
mov edx, str.AVG_Antivirus
mov ecx, 0x52a848
cmovne ecx, edx
push 0x555008
mov dword [0x55500c], ecx
call fcn.004af730
add esp, 4
push 0x10
push dword [0x55500c]
lea eax, [ebp - 0xac8]
push eax
push dword [ebp - 0xfc0]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp - 0xbc4], 8
lea eax, [ebp - 0xbd8]
movq xmm0, qword [str.sfxinst]
cmovae eax, dword [ebp - 0xbd8]
mov dword [ebp - 0x11f8], eax
mov eax, dword [0x52bd4c]
mov dword [ebp - 0xae8], 0x37314446
mov ecx, dword [ebp - 0xae8]
movq qword [ebp - 0xb48], xmm0
xorps xmm0, xmm0
mov dword [ebp - 0xb40], eax
mov dword [ebp - 0xb38], ecx
lea ecx, [ebp - 0xae0]
mov dword [ebp - 0xaec], 0x37434235
mov eax, dword [ebp - 0xaec]
mov dword [ebp - 0xb3c], eax
mov dword [ebp - 0xb34], 0x19
movlpd qword [ebp - 0xae0], xmm0
call fcn.0040add0
mov byte [ebp - 4], 0x62
mov ecx, dword [ebp - 0xae0]
test ecx, ecx
je 0x41ee12
push esi
push dword [ebp - 0x11f8]
lea eax, [ebp - 0xb48]
push str.The_stub_cannot_run_installer_updater_executable__s__code_0x_x_
push eax
push 7
call fcn.00413300
mov ecx, dword [ebp - 0xadc]
mov dword [ebp - 0x1220], ecx
test ecx, ecx
je 0x41ee69
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x41ee69
mov eax, dword [ecx]
mov esi, dword [eax]
mov ecx, esi
call dword [0x4f933c]
mov ecx, dword [ebp - 0x1220]
call esi
mov ecx, dword [ebp - 0x1220]
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x41ee63
mov eax, dword [ecx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4f933c]
mov ecx, dword [ebp - 0x1220]
call esi
mov esi, dword [ebp - 0x1218]
lea ecx, [ebp - 0xe78]
call fcn.0040aa40
mov byte [ebp - 4], 0x63
mov ecx, dword [ebp - 0xddc]
mov eax, dword [ebp - 0xde0]
mov dword [ebp - 0x1204], ecx
cmp eax, ecx
je 0x41eea8
mov esi, eax
mov ecx, esi
call fcn.00423010
add esi, 8
cmp esi, dword [ebp - 0x1204]
jne 0x41ee90
mov esi, dword [ebp - 0x1218]
lea ecx, [ebp - 0xde0]
call fcn.00420210
lea eax, [ebp - 0xe10]
push eax
call fcn.004ad83a
mov eax, dword [ebp - 0xe18]
add esp, 4
push dword [eax + 4]
lea eax, [ebp - 0xe18]
push eax
mov ecx, eax
call fcn.004161a0
push 0x40
push dword [ebp - 0xe18]
call fcn.004af3e3
add esp, 8
lea ecx, [ebp - 0xe30]
call fcn.0040aa40
lea ecx, [ebp - 0x1008]
call fcn.004179c0
lea ecx, [ebp - 0xcac]
mov byte [ebp - 4], 0x14
call fcn.0040aa40
jmp 0x41baa9
cmp dword [ebp - 0xbc4], 8
lea eax, [ebp - 0xbd8]
movq xmm0, qword [str.sfxinst]
cmovae eax, dword [ebp - 0xbd8]
mov esi, dword [ebp - 0x1224]
mov dword [ebp - 0x11f8], eax
mov eax, dword [0x52bd4c]
mov dword [ebp - 0xae8], 0x37314446
mov ecx, dword [ebp - 0xae8]
movq qword [ebp - 0xb48], xmm0
xorps xmm0, xmm0
mov dword [ebp - 0xb40], eax
mov dword [ebp - 0xb38], ecx
lea ecx, [ebp - 0xae0]
mov dword [ebp - 0xaec], 0x37434235
mov eax, dword [ebp - 0xaec]
mov dword [ebp - 0x1218], esi
mov dword [ebp - 0xb3c], eax
mov dword [ebp - 0xb34], 0x19
movlpd qword [ebp - 0xae0], xmm0
call fcn.0040add0
mov byte [ebp - 4], 0x64
mov ecx, dword [ebp - 0xae0]
test ecx, ecx
je 0x41efc8
push esi
push dword [ebp - 0x11f8]
lea eax, [ebp - 0xb48]
push str.Installer_updater_executable__s_finished__process_return_code_0x_x_
push eax
push 2
call fcn.00413300
mov ecx, dword [ebp - 0xadc]
mov dword [ebp - 0x1220], ecx
test ecx, ecx
je 0x41f01f
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x41f01f
mov eax, dword [ecx]
mov esi, dword [eax]
mov ecx, esi
call dword [0x4f933c]
mov ecx, dword [ebp - 0x1220]
call esi
mov ecx, dword [ebp - 0x1220]
mov eax, edi
lock xadd dword [ecx + 8], eax
jne 0x41f019
mov eax, dword [ecx]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4f933c]
mov ecx, dword [ebp - 0x1220]
call esi
mov esi, dword [ebp - 0x1218]
lea ecx, [ebp - 0xe78]
call fcn.0040aa40
mov byte [ebp - 4], 0x65
mov ecx, dword [ebp - 0xddc]
mov eax, dword [ebp - 0xde0]
mov dword [ebp - 0x1204], ecx
cmp eax, ecx
je 0x41f05e
mov esi, eax
mov ecx, esi
call fcn.00423010
add esi, 8
cmp esi, dword [ebp - 0x1204]
jne 0x41f046
mov esi, dword [ebp - 0x1218]
lea ecx, [ebp - 0xde0]
call fcn.00420210
lea eax, [ebp - 0xe10]
push eax
call fcn.004ad83a
mov eax, dword [ebp - 0xe18]
add esp, 4
push dword [eax + 4]
lea eax, [ebp - 0xe18]
push eax
mov ecx, eax
call fcn.004161a0
push 0x40
push dword [ebp - 0xe18]
call fcn.004af3e3
add esp, 8
lea ecx, [ebp - 0xe30]
call fcn.0040aa40
lea ecx, [ebp - 0x1008]
call fcn.004179c0
lea ecx, [ebp - 0xcac]
mov byte [ebp - 4], 0x14
call fcn.0040aa40
jmp 0x41baa9
sub esp, 8
call fcn.0048b530
add esp, 8
cmp byte [ebp - 0x1211], 0
je 0x41f0e2
call fcn.00414270
movq xmm0, qword [str.sfxinst]
mov eax, dword [0x52bd4c]
mov dword [ebp - 0xae8], 0x37314446
mov ecx, dword [ebp - 0xae8]
movq qword [ebp - 0xb48], xmm0
xorps xmm0, xmm0
mov dword [ebp - 0xb40], eax
mov dword [ebp - 0xb38], ecx
lea ecx, [ebp - 0xae0]
mov dword [ebp - 0xaec], 0x37434235
mov eax, dword [ebp - 0xaec]
mov dword [ebp - 0xb3c], eax
mov dword [ebp - 0xb34], 0x19
movlpd qword [ebp - 0xae0], xmm0
call fcn.0040add0
mov byte [ebp - 4], 0x66
mov ecx, dword [ebp - 0xae0]
test ecx, ecx
je 0x41f16b
push esi
push str.Leaving_SFX_stub_guarded_code_section__return_code_0x_x_
lea eax, [ebp - 0xb48]
push eax
push 2
call fcn.00413110
mov ecx, dword [ebp - 0xadc]
mov dword [ebp - 0x1220], ecx
test ecx, ecx
je 0x41f1bb
mov eax, edi
lock xadd dword [ecx + 4], eax
jne 0x41f1bb
mov eax, dword [ecx]
mov esi, dword [eax]
mov ecx, esi
call dword [0x4f933c]
mov ecx, dword [ebp - 0x1220]
call esi
mov eax, dword [ebp - 0x1220]
lock xadd dword [eax + 8], edi
dec edi
jne 0x41f1bb
mov eax, dword [eax]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x4f933c]
mov ecx, dword [ebp - 0x1220]
call esi
lea ecx, [ebp - 0xcc4]
call fcn.0040aa40
lea ecx, [ebp - 0xcf4]
call fcn.0040aa40
lea ecx, [ebp - 0xc60]
call fcn.0040aa40
lea ecx, [ebp - 0xc48]
call fcn.0040aa40
lea ecx, [ebp - 0x11f0]
call fcn.0041f680
mov edx, dword [ebp - 0x125c]
mov byte [ebp - 4], 0xe
test edx, edx
je 0x41f230
mov ecx, dword [ebp - 0xbdc]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x41f226
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41f3d2
push ecx
push edx
call fcn.004af3e3
add esp, 8
lea ecx, [ebp - 0xcdc]
call fcn.0040aa40
lea eax, [ebp - 0xd98]
mov dword [ebp - fcn.0040db40], vtable.ProgressCallback.0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [ebp - 0xd80]
test eax, eax
je 0x41f263
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xd30]
call fcn.0040e6a0
lea ecx, [ebp - 0xd50]
call fcn.0040aa40
lea ecx, [ebp - 0xd68]
call fcn.0040aa40
lea ecx, [ebp - 0xd7c]
call fcn.0040d5e0
mov byte [ebp - 4], 0x67
mov eax, dword [ebp - 0xf38]
mov dword [ebp - 0xeb4], 0
mov esi, dword [eax + 0x18]
mov ecx, esi
call dword [0x4f933c]
lea ecx, [ebp - 0xf38]
call esi
lea eax, [ebp - 0xeac]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea ecx, [ebp - 0xec0]
call fcn.00412440
lea ecx, [ebp - 0xed8]
call fcn.0040aa40
lea ecx, [ebp - 0xef0]
call fcn.0040aa40
lea ecx, [ebp - 0xf18]
call fcn.0040aa40
lea ecx, [ebp - 0xf38]
call fcn.00496500
lea ecx, [ebp - 0xf50]
call fcn.0040aa40
lea ecx, [ebp - 0xbf0]
call fcn.0040b810
lea ecx, [ebp - 0xbfc]
call fcn.004208f0
cmp byte [ebp - 0xc00], 0
je 0x41f32f
lea ecx, [ebp - 0xc18]
call fcn.0040aa40
lea ecx, [ebp - 0xc30]
call fcn.0040aa40
lea ecx, [ebp - 0xe60]
call fcn.0040aa40
lea ecx, [ebp - 0xe48]
call fcn.0040aa40
lea ecx, [ebp - 0xe90]
call fcn.0040aa40
lea ecx, [ebp - 0xb30]
call fcn.0040aa40
lea ecx, [ebp - 0xb60]
call fcn.0040aa40
lea ecx, [ebp - 0xbd8]
call fcn.0040aa40
mov eax, dword [ebp - 0x1218]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004af3ab
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
call fcn.0040a7e0
call fcn.00451b30
push str.Invalid_brand
lea ecx, [ebp - 0x130c]
call fcn.00495720
push 0x549bf4
lea eax, [ebp - 0x130c]
push eax
call fcn.004b1dab
call fcn.0040a7e0
call fcn.004bbc4f
nop
push edi
fld dword [ecx]
pop esi
fld dword [ecx]
lodsb al, byte [esi]
inc ecx
add byte [ebx + esi*8 - 0x2693ffbf], ch
inc ecx
add byte [ebp - 0x27], ah
inc ecx
add dh, al
mov byte [ecx + 0x18], 0