Function at 0x431965
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x14cc
call fcn.004a5e30
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x14c4], eax
push ebx
push ebp
push esi
push edi
cmp ecx, 0x2828
jg 0x430511
je 0x430489
sub ecx, 0x1b6
je 0x43047f
sub ecx, 1
je 0x430390
sub ecx, 1
jne case.0x431674.20373
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x4df1b8
push 0x400
push str.unnamed
push ecx
push 0x4c0b30
push str.TWEAK
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
push str.unnamed
call ebx
lea edi, [esi + 0xa]
test eax, eax
jle 0x430303
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x4302f7
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x4302e4
push str.unnamed
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4df1b8
push 0x400
push str.unnamed
push 0
push 0x4b10dc
push str.TWEAK
call ebp
push str.unnamed
xor esi, esi
call ebx
test eax, eax
jle 0x43035f
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x430353
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x430340
push 0x24
push str.unnamed
lea eax, [esp + 0xc8]
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.0x431674.20373
lea ecx, [eax - 4]
call fcn.00477690
jmp case.0x431674.20373
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x4df1b8
push 0x400
push str.unnamed
push 0
push 0x4c0b28
push str.TWEAK
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
push str.unnamed
call ebx
lea edi, [esi + 0xa]
test eax, eax
jle 0x4303ef
nop dword [eax]
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x4303e3
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x4303d0
push str.unnamed
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4df1b8
push 0x400
push str.unnamed
push 0
push 0x4b10dc
push str.TWEAK
call ebp
push str.unnamed
xor esi, esi
call ebx
test eax, eax
jle 0x43044f
nop dword [eax]
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x430443
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x430430
push 0x24
push str.unnamed
lea eax, [esp + 0xc8]
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.0x431674.20373
xor ecx, ecx
call fcn.00477690
jmp case.0x431674.20373
call fcn.00479430
jmp case.0x431674.20373
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0x130b
push 0x2830
push dword [0x4def88]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
sub eax, 0
je 0x4304d3
sub eax, 1
je 0x4304c7
sub eax, 1
jne 0x4304dd
mov dword [0x4d2c80], 0x2999
jmp 0x4304dd
mov dword [0x4d2c80], 0x2843
jmp 0x4304dd
mov dword [0x4d2c80], 0x2828
call fcn.0046c190
push 0
push 0x4e7e
push dword [0x4def88]
mov dword [0x4c4964], 0x34
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 0x34
jmp 0x431512
cmp ecx, 0x2994
jg 0x430e08
je 0x4306df
add ecx, 0xffffd7d7
cmp ecx, 0xe5
ja case.0x431674.20373
movzx eax, byte [ecx + 0x431c5c]
jmp dword [eax*4 + 0x431be0]
push 0x11
push 0xf
push 0x4de958
push dword [0x4def88]
call fcn.00401149
jmp case.0x431674.20373
call fcn.0043c6f0
call fcn.0046b900
jmp case.0x431674.20373
call fcn.0043c9f0
call fcn.0046b900
jmp case.0x431674.20373
call fcn.0043c440
call fcn.0046b900
jmp case.0x431674.20373
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x43c140
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x431674.20373
push 0x7fc
lea eax, [esp + 0x4d8]
mov dword [esp + 0x4d4], 0
push 0
push eax
call fcn.0048e880
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
add esp, 0xc
push 2
push 0xffffffffffffffff
push 0x100c
push 0x288c
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call esi
lea ecx, [esp + 0x4d0]
mov dword [esp + 0x24], 2
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x1c]
push ecx
push eax
push 0x1073
push 0x288c
push dword [0x4def88]
mov dword [esp + 0x48], 0x400
call edi
push eax
call esi
mov ecx, 0x288c
call fcn.0043a390
call fcn.0046b900
jmp case.0x431674.20373
call fcn.00443ae0
jmp case.0x431674.20373
push 1
push 0
push str.Shell32.dll_Control_RunDLL_Desk.cpl__0_1
push str.rundll32.exe
jmp 0x431686
call fcn.00443720
jmp case.0x431674.20373
call fcn.00443960
jmp case.0x431674.20373
mov eax, dword [0x4ddea0]
cmp eax, 1
jne 0x430695
push 0
push 0x4710f0
push dword [0x4def88]
push str.NAGSCREEN
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
jmp case.0x431674.20373
cmp eax, 0xe9
jl 0x4306a3
cmp eax, 0xeb
jle 0x4306c1
push 0
push 0x4710f0
push dword [0x4def88]
push str.NAGSCREEN
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
call fcn.0043a500
jmp case.0x431674.20373
call fcn.0043a220
jmp case.0x431674.20373
mov ecx, 0x290a
call fcn.0043a390
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x439a40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x431674.20373
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0x130b
push 0x2876
push dword [0x4def88]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 5
ja case.default.0x430724
jmp dword [eax*4 + 0x431d44]
mov dword [0x4d2c80], 0x2829
jmp case.default.0x430724
mov dword [0x4d2c80], 0x2844
jmp case.default.0x430724
mov dword [0x4d2c80], 0x2846
jmp case.default.0x430724
mov dword [0x4d2c80], 0x2847
jmp case.default.0x430724
mov dword [0x4d2c80], 0x2845
jmp case.default.0x430724
mov dword [0x4d2c80], 0x29ce
call fcn.0046c190
push 0
push 0x4e7e
push dword [0x4def88]
mov dword [0x4c4964], 0x66
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 0x66
jmp 0x431512
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0x130b
push 0x289a
push dword [0x4def88]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 4
ja case.default.0x4307cd
jmp dword [eax*4 + 0x431d5c]
mov dword [0x4d2c80], 0x282a
jmp case.default.0x4307cd
mov dword [0x4d2c80], 0x2848
jmp case.default.0x4307cd
mov dword [0x4d2c80], 0x2849
jmp case.default.0x4307cd
mov dword [0x4d2c80], 0x284a
jmp case.default.0x4307cd
mov dword [0x4d2c80], 0x284b
call fcn.0046c190
push 0
push 0x4e7e
push dword [0x4def88]
mov dword [0x4c4964], 0x98
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 0x98
jmp 0x431512
cmp dword [0x4c5198], 0x12c
jne 0x4308b6
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0x130b
push 0x29d1
push dword [0x4def88]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
sub eax, 0
je 0x4308a5
sub eax, 1
je 0x430894
sub eax, 1
jne 0x4308af
mov dword [0x4d2c80], 0x29d3
call fcn.0046c190
jmp 0x4308cb
mov dword [0x4d2c80], 0x29d2
call fcn.0046c190
jmp 0x4308cb
mov dword [0x4d2c80], 0x2a34
call fcn.0046c190
jmp 0x4308cb
mov dword [0x4d2c80], 0x282b
call fcn.0046c190
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x4e7e
push dword [0x4def88]
mov dword [0x4c4964], 0xca
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 0xca
jmp 0x431512
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0x130b
push 0x289b
push dword [0x4def88]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 4
ja case.default.0x430925
jmp dword [eax*4 + 0x431d70]
mov dword [0x4d2c80], 0x282c
jmp case.default.0x430925
mov dword [0x4d2c80], 0x284c
jmp case.default.0x430925
mov dword [0x4d2c80], 0x284d
jmp case.default.0x430925
mov dword [0x4d2c80], 0x284e
jmp case.default.0x430925
mov dword [0x4d2c80], 0x284f
call fcn.0046c190
push 0
push 0x4e7e
push dword [0x4def88]
mov dword [0x4c4964], 0xfc
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 0xfc
jmp 0x431512
mov dword [0x4d2c80], 0x282d
call fcn.0046c190
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0x4e7e
push dword [0x4def88]
mov dword [0x4c4964], 0x12e
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 0x12e
jmp 0x431512
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e880
add esp, 0xc
mov edx, 0x4ad374
mov ecx, str.TWEAK
call fcn.00477440
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475ea0
test eax, eax
je case.0x431674.20373
lea eax, [esp + 0xc0]
push eax
push 0x285e
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp case.0x431674.20373
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e880
add esp, 0xc
mov edx, 0x4ad370
mov ecx, str.TWEAK
call fcn.00477440
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475ea0
test eax, eax
je case.0x431674.20373
lea eax, [esp + 0xc0]
push eax
push 0x285f
jmp 0x430a36
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e880
add esp, 0xc
mov edx, 0x4ad378
mov ecx, str.TWEAK
call fcn.00477440
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475ea0
test eax, eax
je case.0x431674.20373
lea eax, [esp + 0xc0]
push eax
push 0x2860
jmp 0x430a36
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e880
add esp, 0xc
mov edx, 0x4ad08c
mov ecx, str.TWEAK
call fcn.00477440
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475ea0
test eax, eax
je case.0x431674.20373
lea eax, [esp + 0xc0]
push eax
push 0x2861
jmp 0x430a36
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e880
add esp, 0xc
mov edx, 0x4ad0a0
mov ecx, str.TWEAK
call fcn.00477440
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475ea0
test eax, eax
je case.0x431674.20373
lea eax, [esp + 0xc0]
push eax
push 0x2862
jmp 0x430a36
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e880
add esp, 0xc
mov edx, 0x4ad0d0
mov ecx, str.TWEAK
call fcn.00477440
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475ea0
test eax, eax
je case.0x431674.20373
lea eax, [esp + 0xc0]
push eax
push 0x2863
jmp 0x430a36
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e880
add esp, 0xc
mov edx, 0x4ad0cc
mov ecx, str.TWEAK
call fcn.00477440
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475ea0
test eax, eax
je case.0x431674.20373
lea eax, [esp + 0xc0]
push eax
push 0x2864
jmp 0x430a36
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e880
add esp, 0xc
mov edx, 0x4ad0dc
mov ecx, str.TWEAK
call fcn.00477440
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475ea0
test eax, eax
je case.0x431674.20373
lea eax, [esp + 0xc0]
push eax
push 0x2865
jmp 0x430a36
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e880
add esp, 0xc
mov edx, 0x4ad0d4
mov ecx, str.TWEAK
call fcn.00477440
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475ea0
test eax, eax
je case.0x431674.20373
lea eax, [esp + 0xc0]
push eax
push 0x2866
jmp 0x430a36
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e880
add esp, 0xc
mov edx, 0x4ad3dc
mov ecx, str.TWEAK
call fcn.00477440
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475ea0
test eax, eax
je case.0x431674.20373
lea eax, [esp + 0xc0]
push eax
push 0x2867
jmp 0x430a36
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e880
add esp, 0xc
mov edx, 0x4ad444
mov ecx, str.TWEAK
call fcn.00477440
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475ea0
test eax, eax
je case.0x431674.20373
lea eax, [esp + 0xc0]
push eax
push 0x2868
jmp 0x430a36
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e880
add esp, 0xc
mov edx, 0x4ad480
mov ecx, str.TWEAK
call fcn.00477440
lea edx, [esp + 0xc0]
mov ecx, eax
call fcn.00475ea0
test eax, eax
je case.0x431674.20373
lea eax, [esp + 0xc0]
push eax
push 0x2869
jmp 0x430a36
cmp ecx, 0x4f8e
jg 0x431665
je 0x431659
add ecx, 0xffffd66b
cmp ecx, 0xac
ja case.0x431674.20373
movzx eax, byte [ecx + 0x431dbc]
jmp dword [eax*4 + 0x431d84]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x4df1b8
push 0x400
push str.unnamed
push 0
push 0x4b10dc
push str.TWEAK
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
push str.unnamed
call ebx
lea edi, [esi + 0xa]
test eax, eax
jle 0x430e92
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x430e86
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x430e73
push str.unnamed
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4df1b8
push 0x400
push str.unnamed
push 0
push 0x4b3694
push str.TWEAK
call ebp
push str.unnamed
xor esi, esi
call ebx
test eax, eax
jle 0x430eef
nop
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x430ee3
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x430ed0
push 0x24
lea eax, [esp + 0x2cc]
push eax
push str.unnamed
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.0x431674.20373
xor eax, eax
push 0x206
push eax
mov word [esp + 0xc8], ax
lea eax, [esp + 0xca]
push eax
call fcn.0048e880
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0xcc]
add esp, 0xc
push 0x104
push eax
call ebx
mov edi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0xc0]
push str.System32OneDriveSetup.exe
push eax
call edi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esp + 0xc0]
push 5
push 0
push str._uninstall
push eax
push str.open
push dword [0x4def88]
call esi
push 0x104
lea eax, [esp + 0xc4]
push eax
call ebx
push str.SysWOW64OneDriveSetup.exe
lea eax, [esp + 0xc4]
push eax
call edi
push 5
push 0
push str._uninstall
lea eax, [esp + 0xcc]
push eax
push str.open
push dword [0x4def88]
call esi
jmp case.0x431674.20373
mov edx, 0x4b0894
mov ecx, str.TWEAK
call fcn.00477440
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [esp + 0x2c8]
mov ecx, str.photoviewer.reg
call fcn.004440f0
jmp case.0x431674.20373
mov edx, 0x4b08bc
mov ecx, str.TWEAK
call fcn.00477440
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [esp + 0x2c8]
mov ecx, str.fix_ico.reg
call fcn.004440f0
jmp case.0x431674.20373
mov edx, 0x4b08dc
mov ecx, str.TWEAK
call fcn.00477440
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [esp + 0x2c8]
mov ecx, str.fix_lnk.reg
call fcn.004440f0
jmp case.0x431674.20373
mov edx, 0x4b08fc
mov ecx, str.TWEAK
call fcn.00477440
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [esp + 0x2c8]
mov ecx, str.fix_exe.reg
call fcn.004440f0
jmp case.0x431674.20373
mov edx, 0x4b091c
mov ecx, str.TWEAK
call fcn.00477440
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [esp + 0x2c8]
mov ecx, str.fix_folder.reg
call fcn.004440f0
jmp case.0x431674.20373
mov edx, 0x4b0944
mov ecx, str.TWEAK
call fcn.00477440
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea edx, [esp + 0x2c8]
mov ecx, str.fix_drive.reg
call fcn.004440f0
jmp case.0x431674.20373
push 1
push 0
push str.system
push str.control
jmp 0x431686
lea eax, [esp + 0x10]
push eax
push 0
push 0
push 0x43b600
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x431674.20373
push 0x7fc
lea eax, [esp + 0x4d8]
mov dword [esp + 0x4d4], 0
push 0
push eax
call fcn.0048e880
add esp, 0xc
mov dword [esp + 0xcd0], 0
lea eax, [esp + 0xcd4]
push 0x7fc
push 0
push eax
call fcn.0048e880
add esp, 0xc
push 0x28c8
push dword [0x4def88]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
push 2
push 0xffffffffffffffff
push 0x100c
push ebx
call edi
mov esi, eax
mov dword [esp + 0x70], 5
lea eax, [esp + 0x4d0]
mov dword [esp + 0x80], 0x400
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x68]
push eax
push esi
push 0x1073
push ebx
call edi
lea eax, [esp + 0xcd0]
mov dword [esp + 0x70], 0
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x68]
push eax
push esi
push 0x1073
push ebx
mov dword [esp + 0x90], 0x400
call edi
cmp word [esp + 0x4d0], 0
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0x4df1b8
push 0x400
push str.unnamed
push 0
jne 0x4312d0
push 0x4ad0a4
push str.TWEAK
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
push str.unnamed
call ebx
lea edi, [esi + 0xa]
test eax, eax
jle 0x431254
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x431248
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x431235
push str.unnamed
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4df1b8
push 0x400
push str.unnamed
push 0
push 0x4b10d4
push str.TWEAK
call ebp
push str.unnamed
xor esi, esi
call ebx
test eax, eax
jle 0x4312b0
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x4312a4
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x431291
push 0x30
lea eax, [esp + 0x2cc]
push eax
push str.unnamed
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp case.0x431674.20373
push 0x4aeb88
push 0x4ad9cc
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
push str.unnamed
call ebx
lea edi, [esi + 0xa]
test eax, eax
jle 0x431311
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x431305
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x4312f2
push str.unnamed
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0xcd0]
push eax
lea eax, [esp + 0xc4]
push eax
call esi
push 0x4ae628
lea eax, [esp + 0xc4]
push eax
call esi
push 0x4df1b8
push 0x400
push str.unnamed
push 0
push 0x4adcec
push str.PRVCY
call ebp
push str.unnamed
xor esi, esi
call ebx
test eax, eax
jle 0x431394
cmp word [esi*2 + str.unnamed], 0x7e
jne 0x431388
mov word [esi*2 + str.unnamed], di
push str.unnamed
inc esi
call ebx
cmp esi, eax
jl 0x431375
push 0x24
push str.unnamed
lea eax, [esp + 0xc8]
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne case.0x431674.20373
lea eax, [esp + 0x4d0]
push eax
push str._T:97__K_pnputil__d__s
lea eax, [esp + 0xcd8]
push 0x400
push eax
call fcn.0040a3c0
mov eax, dword [0x4def88]
add esp, 0x10
mov dword [esp + 0x24], eax
xorps xmm0, xmm0
lea eax, [esp + 0xcd0]
movlpd qword [esp + 0x40], xmm0
mov dword [esp + 0x30], eax
mov eax, dword [0x4deb64]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
push eax
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0x54], xmm0
mov dword [esp + 0x20], 0x3c
mov dword [esp + 0x24], 0x40
mov dword [esp + 0x2c], str.open
mov dword [esp + 0x30], 0x4b0574
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [esp + 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.0043aae0
jmp case.0x431674.20373
lea eax, [esp + 0x10]
push eax
push 0
push 0
push fcn.0043aae0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp case.0x431674.20373
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0
push 0x130b
push 0x29f9
push dword [0x4def88]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 4
ja case.default.0x4314a2
jmp dword [eax*4 + 0x431e6c]
mov dword [0x4d2c80], 0x29fa
jmp case.default.0x4314a2
mov dword [0x4d2c80], 0x29fb
jmp case.default.0x4314a2
mov dword [0x4d2c80], 0x29fc
jmp case.default.0x4314a2
mov dword [0x4d2c80], 0x29fd
jmp case.default.0x4314a2
mov dword [0x4d2c80], 0x29fe
call fcn.0046c190
push 0
push 0x4e7e
push dword [0x4def88]
mov dword [0x4c4964], 2
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 1
push 0x30
push 0x76
push 2
mov eax, dword [0x4def8c]
add eax, 0x336
push eax
push 0x4e7e
push dword [0x4def88]
call edi
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push 0x4e7e
push dword [0x4def88]
call edi
push eax
call esi
call fcn.0046b900
jmp case.0x431674.20373
push 0x208
lea eax, [esp + 0xc4]
push 0
push eax
call fcn.0048e880
add esp, 0xc
lea eax, [esp + 0x68]
push 0x58
push 0
push eax
call fcn.0048e880
mov eax, dword [0x4deb64]
add esp, 0xc
mov dword [esp + 0x70], eax
mov eax, dword [0x4def88]
mov dword [esp + 0x6c], eax
lea eax, [esp + 0xc0]
mov dword [esp + 0x84], eax
lea eax, [esp + 0x68]
push eax
mov dword [esp + 0x6c], 0x58
mov dword [esp + 0xa0], 0x81824
mov dword [esp + 0x78], str.BMP_Files__.bmp_
mov dword [esp + 0x9c], str.Select_a_logo_file:
mov dword [esp + 0x98], 0x4b0a54
mov dword [esp + 0x8c], 0x104
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
mov dword [esp + 0xb0], 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
lea eax, [esp + 0xc0]
push eax
push 0x29a6
push dword [0x4def88]
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x10
push 0x78
push 0x78
push 0
lea eax, [esp + 0xd0]
push eax
push dword [0x4deb64]
call dword [sym.imp.USER32.dll_LoadImageW]
push eax
push 0
push 0x172
push 0x29a9
push dword [0x4def88]
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x431674.20373
push 1
push str.cleanmgr__sageset:1
jmp 0x431bbb
add ecx, 0xffffb071
cmp ecx, 0x16
ja case.0x431674.20373
jmp dword [ecx*4 + 0x431e80]
push 5
push 0
push 0
push str.Shell:::D20EA4E1_3957_11d2_A40B_0C5020524153
push str.open
push dword [0x4def88]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp case.0x431674.20373
push 1
push str.control__name_Microsoft.Troubleshooting
jmp 0x431bbb
push 5
push 0
push 0
push str.Shell:::74246bfc_4c96_11d0_abef_0020af6b0b7a
jmp 0x431686
push 5
push 0
push 0
push str.Shell:::BB64F8A7_BEE7_4E1A_AB8D_7D8273F7FDB6
jmp 0x431686
push 5
push 0
push 0
push str.Shell:::d450a8a1_9568_45c7_9c0e_b4f9fb4537bd
jmp 0x431686
push 0x104
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.logscbscbs.log
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 5
push 0
lea eax, [esp + 0xc8]
push eax
push str.notepad.exe
jmp 0x431686
push 0x104
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.logsDISMdism.log
jmp 0x4316e7
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4ad8b0
push 0x24
push eax
mov ecx, str.WNFX
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x431bb0
push 1
push 0
push str._T:97__K_SFC__scannow
push 0x4b0574
jmp 0x431686
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4ad8b8
push 0x24
push eax
mov ecx, str.WNFX
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x431bb0
push 1
push 0
push str._T:97__K_DISM__Online__Cleanup_Image__ScanHealth
push 0x4b0574
jmp 0x431686
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4ad8c0
push 0x24
push eax
mov ecx, str.WNFX
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x431bb0
push 1
push 0
push str._T:97__K_DISM__Online__Cleanup_Image__RestoreHealth
push 0x4b0574
jmp 0x431686
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4ad8e8
push 0x24
push eax
mov ecx, str.WNFX
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x431bb0
push 1
push 0
push str._T:97__K_Dism.exe__Online__Cleanup_Image__AnalyzeComponentStore
push 0x4b0574
jmp 0x431686
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4ad8f0
push 0x24
push eax
mov ecx, str.WNFX
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x431bb0
push 1
push 0
push str._T:97__K_Dism.exe__Online__Cleanup_Image__StartComponentCleanup
push 0x4b0574
jmp 0x431686
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4ad95c
push 0x24
push eax
mov ecx, str.WNFX
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x431bb0
push 1
push 0
push str._T:97__K_Dism.exe__online__Cleanup_Image__StartComponentCleanup__ResetBase
push 0x4b0574
jmp 0x431686
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4ad984
push 0x24
push eax
mov ecx, str.WNFX
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x431bb0
push 1
push 0
push str._T:97__K_Dism__Cleanup_Mountpoints
push 0x4b0574
jmp 0x431686
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4ad98c
push 0x24
push eax
mov ecx, str.WNFX
call fcn.00477440
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
push eax
push dword [0x4def88]
call edi
cmp eax, 6
jne 0x431bb0
push 0x104
lea eax, [esp + 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xor eax, eax
mov word [esp + 0xc6], ax
lea eax, [esp + 0x10]
push eax
push 0
push 0
lea eax, [esp + 0xcc]
push eax
call esi
mov eax, dword [0x4def88]
xorps xmm0, xmm0
mov dword [esp + 0x24], eax
mov eax, dword [0x4deb64]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x1c]
push eax
movlpd qword [esp + 0x44], xmm0
movlpd qword [esp + 0x4c], xmm0
movlpd qword [esp + 0x54], xmm0
mov dword [esp + 0x20], 0x3c
mov dword [esp + 0x24], 0x440
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], str.cleanmgr
mov dword [esp + 0x34], str._sagerun:1
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [esp + 0x54]
test eax, eax
je 0x431acf
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x58]
xorps xmm0, xmm0
push eax
push 0
push 0
lea eax, [esp + 0xcc]
movlpd qword [esp + 0x6c], xmm0
push eax
call esi
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x5c]
cmp ecx, esi
jb 0x431b0b
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x58]
ja 0x431b05
cmp eax, edx
jbe 0x431b0b
sub eax, edx
sbb ecx, esi
jmp 0x431b13
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x60]
push ecx
push eax
call fcn.00464970
add esp, 8
mov edx, 0x4ad99c
mov ecx, str.WNFX
push eax
call fcn.00477440
push eax
lea eax, [esp + 0xc8]
push 0x104
push eax
call fcn.0040a3c0
add esp, 0x10
mov edx, 0x4aeb40
mov ecx, str.PRVCY
push 0x40
call fcn.00477440
push eax
lea eax, [esp + 0xc8]
push eax
push dword [0x4def88]
call edi
jmp case.0x431674.20373
mov edx, 0x4ad0a4
mov ecx, 0x4ad9cc
call fcn.00477440
push eax
lea eax, [esp + 0x2cc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x2c8]
mov edx, 0x4ad994
push 0x24
push eax
mov ecx, str.WNFX
call fcn.00477440
push eax
push dword [0x4def88]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x431bb4
xor eax, eax
jmp 0x431bc6
push 1
push str.cleanmgr__verylowdisk
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, 1
mov ecx, dword [esp + 0x14d4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d925
add esp, 0x14cc
ret