Function at 0x42d0b3
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Check mutex on windows
Create process on windows
Execute shellcode via indirect call
Get common file path
Get disk size
Get process heap force flags
Move file
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe3c
push ebx
push esi
xor ebx, ebx
xor eax, eax
push edi
inc ebx
mov dword [esp + 0x24], eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [ebp + 8]
xor edi, edi
push edi
mov dword [0x4ab21c], eax
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, eax
mov dword [esp + 0x88], 8
lea eax, [esp + 0x88]
mov dword [esp + 0xb0], esi
push eax
mov dword [esp + 0x90], 0xffff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov eax, dword [0x4ab710]
mov dword [0x4ab2ac], edi
mov edi, dword [0x4ab70c]
jmp 0x42d135
mov ecx, dword [edi]
test ecx, ecx
je 0x42d132
push ebx
call dword [ecx + 0x1c]
mov eax, dword [0x4ab710]
add edi, 4
cmp edi, eax
jb 0x42d123
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edi, edi
mov dword [0x4ab2b0], eax
push 0xc
mov dword [0x4ab2b4], edi
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x42d165
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
jmp 0x42d167
mov eax, edi
mov dword [0x4ab2b4], eax
lea ecx, [esp + 0x600]
neg eax
mov dword [esp + 0xc0], 0x49158c
sbb eax, eax
not eax
and dword [0x4ab2b8], eax
lea eax, [esp + 0xc0]
push eax
mov dword [esp + 0xe8], eax
call fcn.0043aa99
lea ecx, [esp + 0xc0]
call fcn.0043aa7b
push 0x104
lea eax, [esp + 0x62c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ecx, eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x628]
sub ecx, eax
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x18]
call fcn.0043a92d
mov edi, 0x4ab30c
push eax
mov ecx, edi
call fcn.0043b599
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.0043c924
push str.ConfigConfig.ini
mov edx, edi
lea ecx, [esp + 0x14]
call fcn.0043ab55
pop ecx
push eax
mov ecx, 0x4ab4f0
call fcn.0043b599
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.0043c924
xor eax, eax
push eax
push 0x80
push ebx
push eax
push ebx
push 0x40000000
push dword [0x4ab4f0]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x42d269
xor eax, eax
push eax
lea eax, [esp + 0x3c]
push eax
push 2
push 0x486320
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0042c394
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x42d2a0
push 0x40
push 0x486080
call sym.Dismx86.exe_DismMultiLanguage
push eax
push str.Dism__
call sym.Dismx86.exe_DismMultiLanguage
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 5
jmp 0x42d336
mov edi, dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
lea eax, [esp + 0x17]
push eax
xor eax, eax
push eax
push ebx
push 0x11
call edi
test eax, eax
jne 0x42d2d8
lea eax, [esp + 0x17]
push eax
xor eax, eax
push eax
push ebx
push 0x12
call edi
test eax, eax
jne 0x42d2d8
mov byte [esp + 0x17], bl
mov dword [0x4ab220], 4
jmp 0x42d2de
xor eax, eax
mov byte [esp + 0x17], al
push str.Configx86CbsHost.Dll
mov edx, 0x4ab30c
lea ecx, [esp + 0x14]
call fcn.0043ab55
pop ecx
mov ecx, dword [eax]
call fcn.00481afc
mov ecx, dword [esp + 0x10]
mov dword [0x4ab250], eax
lea ecx, [ecx - 0x10]
call fcn.0043c924
cmp dword [0x4ab250], 0
jne 0x42d33c
push 0x10
push 0x486308
call sym.Dismx86.exe_DismMultiLanguage
push eax
push 0x48ff68
call sym.Dismx86.exe_DismMultiLanguage
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 3
pop ebx
jmp 0x42eb82
call fcn.0044bc9f
test eax, eax
je 0x42d36e
push 0x40
push 0x486080
call sym.Dismx86.exe_DismMultiLanguage
push eax
push 0x497298
call sym.Dismx86.exe_DismMultiLanguage
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor ebx, ebx
inc ebx
jmp 0x42eb82
push 0x4972e4
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x42d3d7
push 0x42ed1f
call edi
xor eax, eax
mov dword [esp + 0x28], 0x4c2c033
mov byte [esp + 0x2c], al
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x42d3d7
push 5
lea eax, [esp + 0x2c]
push eax
push edi
call dword [sym.imp.msvcrt.dll_memcpy]
add esp, 0xc
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x14]
push 5
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push str.Dismx86.exe
push dword [esp + 0x40]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x42d414
xor ebx, ebx
push ebx
push 0x486080
call sym.Dismx86.exe_DismMultiLanguage
push eax
push 0x497300
call sym.Dismx86.exe_DismMultiLanguage
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, 0x80004005
jmp 0x42eb82
xor eax, eax
push eax
push eax
push 3
push eax
push 5
push 0xa0000000
lea eax, [esp + 0x640]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ecx, ecx
mov dword [esp + 0x10], eax
push ecx
push ecx
push ecx
push eax
call dword [sym.imp.ntdll.dll_LdrVerifyImageMatchesChecksum]
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.0043ab9a
test edi, edi
je 0x42d455
mov dword [0], ebx
xor eax, eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xa4], eax
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0xb8]
push eax
push 0xffffffffffffffff
call dword [0x485654]
mov eax, dword [esp + 0xa4]
mov ecx, 0x14c
cmp ax, cx
je 0x42d596
movzx eax, ax
cmp eax, 0x8664
je 0x42d4d4
cmp eax, 0xaa64
je 0x42d4cd
xor ebx, ebx
push ebx
push 0x486080
call sym.Dismx86.exe_DismMultiLanguage
push eax
push 0x49733c
call sym.Dismx86.exe_DismMultiLanguage
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, 0x80004001
jmp 0x42eb82
mov edi, str.DismARM64.exe
jmp 0x42d4d9
mov edi, str.Dismx64.exe
xor eax, eax
mov dword [esp + 0xc0], 0x44
push 0x40
push eax
lea eax, [esp + 0xcc]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov word [esp + 0xf0], bx
mov edx, 0x4ab30c
mov dword [esp + 0xec], ebx
lea ecx, [esp + 0x10]
push edi
call fcn.0043ab55
pop ecx
lea ecx, [esp + 0x94]
push ecx
lea ecx, [esp + 0xc4]
push ecx
xor ecx, ecx
push ecx
push ecx
push 0x4000410
push ecx
push ecx
push ecx
push dword [ebp + 0x10]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 0x10]
mov edi, eax
add ecx, 0xfffffff0
call fcn.0043c924
test edi, edi
je 0x42d56b
push dword [esp + 0x98]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [esp + 0x94]
call edi
jmp 0x42d58d
xor eax, eax
push eax
push 0x486080
call sym.Dismx86.exe_DismMultiLanguage
push eax
push 0x497378
call sym.Dismx86.exe_DismMultiLanguage
push eax
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [esp + 0x10], ebx
jmp 0x42eb82
lea eax, [esp + 0x7f]
push eax
xor eax, eax
push eax
push ebx
push 0x13
call dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
call fcn.0043c5cd
push eax
lea ecx, [esp + 0x1c]
call fcn.0043ac50
cmp byte [esp + 0x17], 0
mov edi, 0x4973d4
jne 0x42d5e9
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push edi
lea ecx, [esp + 0x20]
call fcn.0043b96c
push 0x4973e0
call sym.Dismx86.exe_DismMultiLanguage
push eax
lea ecx, [esp + 0x1c]
call fcn.0043b9f9
xor eax, eax
mov edi, eax
mov word [esp + 0x830], ax
mov dword [esp + 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], edi
test eax, eax
je 0x42d66e
xor edx, edx
cmp word [eax], dx
je 0x42d66e
lea ecx, [esp + 0x40]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
mov dword [esp + 0xc], edi
test edi, edi
je 0x42d66e
push str._ScratchDir
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x42d66e
dec dword [esp + 0x40]
cmp dword [edi + 4], eax
je 0x42d666
push dword [edi + 4]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x42d666
push dword [edi + 4]
lea eax, [esp + 0x834]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
add edi, 8
dec dword [esp + 0x40]
mov dword [esp + 0xc], edi
jmp 0x42d69d
push 0x57
pop ebx
jmp 0x42eb76
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x208
push eax
lea eax, [esp + 0x834]
push eax
xor eax, eax
push eax
push 2
push str.TEMP
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
xor ecx, ecx
lea eax, [esp + 0x60]
push eax
push ecx
push ecx
lea eax, [esp + 0x83c]
mov dword [esp + 0x6c], ecx
push eax
mov dword [esp + 0x74], ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0x496ffc
mov edx, 0x4ab30c
lea ecx, [esp + 0x84]
call fcn.0043ab55
pop ecx
xor eax, eax
push eax
push 0x2000080
push 2
push eax
push 7
push 0x40000000
push dword [esp + 0x98]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x64], ebx
ja 0x42d7c5
jb 0x42d715
cmp dword [esp + 0x60], 0x40000000
jae 0x42d7c5
push dword [0x4ab30c]
call dword [sym.imp.SHLWAPI.dll_PathIsNetworkPathW]
test eax, eax
jne 0x42d799
cmp esi, 0xffffffff
je 0x42d799
xor ecx, ecx
lea eax, [esp + 0x60]
push eax
push ecx
push ecx
push dword [0x4ab30c]
mov dword [esp + 0x70], ecx
mov dword [esp + 0x74], ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp dword [esp + 0x64], ebx
jb 0x42d799
ja 0x42d759
cmp dword [esp + 0x60], 0x40000000
jb 0x42d799
mov eax, dword [0x4ab30c]
mov esi, dword [sym.imp.msvcrt.dll_memcpy]
mov ecx, dword [eax - 0xc]
add ecx, ecx
push ecx
push eax
lea eax, [esp + 0x838]
push eax
call esi
mov eax, dword [0x4ab30c]
lea ecx, [esp + 0x83c]
add esp, 0xc
mov eax, dword [eax - 0xc]
push 0x18
push str.ConfigTemp
lea eax, [ecx + eax*2]
push eax
call esi
add esp, 0xc
jmp 0x42d7c5
mov esi, 0x4973d4
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push esi
lea ecx, [esp + 0x20]
call fcn.0043b96c
push 0x497518
call sym.Dismx86.exe_DismMultiLanguage
push eax
lea ecx, [esp + 0x1c]
call fcn.0043b9f9
mov eax, dword fs:[0x18]
xor esi, esi
xor edx, edx
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shld esi, ecx, 0x10
shl ecx, 0x10
or esi, edx
or ecx, dword [eax + 0xa8]
movzx eax, word [eax + 0xac]
shld esi, ecx, 0x10
cdq
shl ecx, 0x10
or esi, edx
or ecx, eax
shld esi, ecx, 0x10
shl ecx, 0x10
cmp esi, 0xa0000
jb 0x42d89a
ja 0x42d81b
xor eax, eax
cmp ecx, eax
jb 0x42d89a
jmp 0x42d81d
xor eax, eax
add ecx, 0xc5990000
adc esi, 0xfff5ffff
cmp esi, eax
ja 0x42d865
jb 0x42d837
cmp ecx, 0xdffff
ja 0x42d865
mov esi, 0x4973d4
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push esi
lea ecx, [esp + 0x20]
call fcn.0043b96c
push str.S_MRHr_gW
call sym.Dismx86.exe_DismMultiLanguage
push eax
lea ecx, [esp + 0x1c]
call fcn.0043b9f9
jmp 0x42d86a
mov esi, 0x4973d4
call fcn.00415279
test al, al
jne 0x42d89a
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push esi
lea ecx, [esp + 0x20]
call fcn.0043b96c
push 0x4975f8
call sym.Dismx86.exe_DismMultiLanguage
push eax
lea ecx, [esp + 0x1c]
call fcn.0043b9f9
xor ecx, ecx
lea eax, [esp + 0xc40]
mov esi, 0x104
mov dword [esp + 0xa8], ecx
push esi
push eax
mov dword [esp + 0xb4], ecx
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x42d902
cmp eax, esi
jae 0x42d902
push 0x490cc8
lea eax, [esp + 0xc44]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x42d902
xor eax, eax
lea edx, [esp + 0xa8]
push eax
lea ecx, [esp + 0xc44]
call fcn.0044c96a
pop ecx
push str.Configx86wimgapi.dll
mov edx, 0x4ab30c
lea ecx, [esp + 0x24]
call fcn.0043ab55
mov esi, dword [esp + 0x24]
lea edx, [esp + 0x8c]
pop ecx
xor eax, eax
mov ecx, esi
push eax
call fcn.0044c96a
mov eax, dword [esp + 0xb0]
pop ecx
cmp eax, dword [esp + 0x8c]
jb 0x42d965
ja 0x42d94e
mov eax, dword [esp + 0xa8]
cmp eax, dword [esp + 0x88]
jb 0x42d965
mov ecx, 0x490cc8
call fcn.00481afc
mov dword [0x4ab20c], eax
test eax, eax
jne 0x42d9b7
mov ecx, esi
jmp 0x42d97a
mov ecx, esi
call fcn.00481afc
mov dword [0x4ab20c], eax
test eax, eax
jne 0x42d9b7
mov ecx, 0x490cc8
call fcn.00481afc
mov dword [0x4ab20c], eax
test eax, eax
jne 0x42d9b7
push 0x4973d4
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push 0x4973d4
lea ecx, [esp + 0x20]
call fcn.0043b96c
push 0x497670
call sym.Dismx86.exe_DismMultiLanguage
push eax
lea ecx, [esp + 0x1c]
call fcn.0043b9f9
lea ecx, [esi - 0x10]
call fcn.0043c924
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], 0
je 0x42da10
lea eax, [esp + 0x18]
push eax
push 0x4976a0
call sym.Dismx86.exe_DismMultiLanguage
mov edx, eax
lea ecx, [esp + 0x88]
call fcn.00430fb9
pop ecx
push 0x30
push 0x486080
mov esi, eax
call sym.Dismx86.exe_DismMultiLanguage
push eax
push dword [esi]
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x84]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov edx, dword [esp + 0x80]
lea eax, [esp + 0x830]
push eax
call fcn.00412987
mov esi, eax
mov dword [esp + 0x20], esi
test esi, esi
jne 0x42eb29
push str.ConfigUpdateInfo.zip
mov edx, 0x4ab30c
lea ecx, [esp + 0x14]
call fcn.0043ab55
pop ecx
mov edx, 0x4ab3c0
mov ecx, dword [eax]
call fcn.0042c16e
mov ecx, dword [esp + 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0043c924
test esi, esi
jne 0x42da7b
mov esi, 0x4ab3c0
mov ecx, esi
call fcn.00409765
test al, al
jne 0x42da7b
mov ecx, esi
call fcn.00438a69
test edi, edi
je 0x42e7d8
cmp dword [edi], 0
je 0x42e7d8
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpIW]
xor eax, eax
push str._Update
push dword [edi]
mov dword [esp + 0x18], eax
call esi
push str._Crash
test eax, eax
jne 0x42dc8f
push dword [edi + 4]
call esi
neg eax
sbb eax, eax
inc eax
mov dword [0x4aa108], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push eax
xor eax, eax
push eax
push 0x400
call edi
mov dword [esp + 0x1c], eax
test eax, eax
je 0x42db37
xor edx, edx
lea ecx, [esp + 0x128]
push edx
push 0x18
push ecx
push edx
push eax
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov esi, eax
test esi, esi
je 0x42db05
lea ecx, [esp + 0x1c]
call fcn.004387e2
jmp 0x42eb5e
push dword [esp + 0x13c]
xor eax, eax
push eax
push 0x100000
call edi
lea ecx, [esp + 0x1c]
mov esi, eax
call fcn.004387e2
push 0xffffffffffffffff
push esi
mov dword [esp + 0x24], esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0x1c]
call fcn.004387e2
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x4ab30c
lea ecx, [esp + 0x34]
push str.ConfigPluginsFrogPlugins_Pcn7FMvReAsVWfCQBfRJCw
mov edx, edi
call fcn.0043ab55
mov edx, edi
mov dword [esp], str.ConfigPlugins4d420a2e_ea11_450a_b8a0_ab8ca7772043
lea ecx, [esp + 0x60]
mov esi, dword [eax]
call fcn.0043ab55
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor edx, edx
pop ecx
push edx
push esi
push dword [eax]
call edi
mov ecx, dword [esp + 0x5c]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov ecx, dword [esp + 0x34]
lea ecx, [ecx - 0x10]
call fcn.0043c924
push str.ConfigPluginsFrogPlugins_Pcn7FMvReAsVWfCQBfRJCw
mov edx, 0x4ab30c
lea ecx, [esp + 0x50]
call fcn.0043ab55
mov edx, 0x4ab30c
mov dword [esp], str.ConfigPluginsFogPlugins_Pcn7FMvReAsVWfCQBfRJCw
lea ecx, [esp + 0x54]
mov esi, dword [eax]
call fcn.0043ab55
pop ecx
xor ecx, ecx
push ecx
push esi
push dword [eax]
call edi
mov ecx, dword [esp + 0x50]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov ecx, dword [esp + 0x4c]
lea ecx, [ecx - 0x10]
call fcn.0043c924
push str.ConfigPluginsNCleaner_RGlzbVBsdWdATTItVXRpbA
mov edx, 0x4ab30c
lea ecx, [esp + 0x4c]
call fcn.0043ab55
pop ecx
mov edx, ebx
mov ecx, dword [eax]
call fcn.0044bfcd
mov ecx, dword [esp + 0x48]
add ecx, 0xfffffff0
call fcn.0043c924
push ecx
mov ecx, dword [0x4ab30c]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.0043baa0
add eax, 0x10
mov dword [esi], eax
call fcn.0042c91d
cmp dword [0x4aa108], 0
pop ecx
jne 0x42dc7f
call fcn.0040593a
test eax, eax
je 0x42dc7f
push 3
lea ecx, [esp + 0x62c]
call fcn.00403206
mov dword [esp + 0x69c], ebx
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp dword [esp + 0x62c], 0
jne 0x42dc60
mov dword [esp + 0x62c], eax
xor eax, eax
push eax
push eax
push eax
lea eax, [esp + 0x634]
push eax
call dword [sym.imp.COMCTL32.dll_Ordinal_345]
lea ecx, [esp + 0x628]
call fcn.00405afd
lea ecx, [esp + 0x1c]
call fcn.004387e2
xor eax, eax
jmp 0x42e7df
push dword [edi]
call esi
test eax, eax
jne 0x42e5ca
cmp dword [esp + 0x40], 4
je 0x42dcaa
or ebx, 0xffffffff
jmp 0x42eb60
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
xor eax, eax
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x42dd04
xor ecx, ecx
lea eax, [esp + 0x1b0]
push ecx
push 0x18
push eax
push ecx
push esi
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
jne 0x42dd09
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x1c4]
xor eax, eax
push eax
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [esp + 0x20], esi
test esi, esi
jne 0x42dd10
call fcn.0044bc4b
mov ebx, eax
jmp 0x42eb60
push 0xa
xor eax, eax
push eax
push dword [edi + 8]
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
mov dword [esp + 0x6c], eax
xor eax, eax
mov dword [esp + 0x74], ebx
mov dword [esp + 0x5c], eax
push 0x434
push eax
lea eax, [esp + 0x1d0]
push eax
call sub.msvcrt.dll_memset
or dword [esp + 0x1fc], 0xffffffff
lea ecx, [esp + 0x1d4]
or dword [esp + 0x200], 0xffffffff
add esp, 0xc
or dword [esp + 0x1f8], 0xffffffff
call fcn.00470c1e
mov ecx, dword [0x4ab21c]
lea edx, [esp + 0x1d8]
xor eax, eax
push eax
call fcn.0044c908
pop ecx
xor eax, eax
lea edx, [esp + 0x1e0]
push eax
mov ecx, 0x48f964
call fcn.0044c96a
pop ecx
push 0x10
xor eax, eax
push eax
push dword [edi + 4]
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
mov dword [esp + 0x70], eax
xor ecx, ecx
push ecx
push 4
lea ecx, [esp + 0x64]
push ecx
push eax
push esi
call dword [sym.imp.ntdll.dll_NtReadVirtualMemory]
test eax, eax
jne 0x42ddfb
push eax
push 0x50
lea eax, [esp + 0x148]
push eax
push dword [esp + 0x68]
push esi
call dword [sym.imp.ntdll.dll_NtReadVirtualMemory]
mov eax, dword [esp + 0x14c]
mov ecx, dword [esp + 0x140]
cdq
mov dword [esp + 0x1f0], eax
mov dword [esp + 0x1f4], edx
mov dword [esp + 0x1f8], ecx
jmp 0x42de09
mov edx, dword [esp + 0x1f4]
mov eax, dword [esp + 0x1f0]
and eax, edx
cmp eax, 0xffffffff
je 0x42de5e
push 0x200
lea eax, [esp + 0x200]
push eax
push dword [esp + 0x1f8]
push esi
call dword [sym.imp.PSAPI.DLL_GetMappedFileNameW]
push 0x1c
lea eax, [esp + 0xc4]
push eax
push dword [esp + 0x1f8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42de5e
mov eax, dword [esp + 0xc4]
sub dword [esp + 0x1f0], eax
push 0
pop eax
sbb dword [esp + 0x1f4], eax
call fcn.0043c5cd
push eax
lea ecx, [esp + 0x38]
call fcn.0043ac50
mov ecx, dword [0x4ab4f0]
lea eax, [esp + 0x34]
push eax
push str.LastCrashTime
mov edx, 0x486104
call fcn.0044d2be
xor eax, eax
push eax
call dword [sym.imp.msvcrt.dll__time64]
add esp, 0xc
mov dword [esp + 0xb8], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0xbc], edx
lea ecx, [esp + 0xb8]
push str._Y__m__d
push eax
call fcn.00439b13
lea eax, [esp + 0x1fc]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
lea eax, [esp + 0x200]
push eax
lea ecx, [esp + 0x24]
call fcn.0043b96c
push dword [esp + 0x1f0]
lea eax, [esp + 0x20]
push 0x4978f8
push eax
call fcn.0043b264
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x134]
add esp, 0xc
mov edx, dword [ecx - 0xc]
push 0x10
push eax
push 0x8003
add edx, edx
call fcn.0044b2b2
add esp, 0xc
lea edx, [esp + 0x128]
lea ecx, [esp + 0x24]
push 0x10
call fcn.0044a0ec
pop ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0043b599
mov ecx, dword [esp + 0x24]
lea ecx, [ecx - 0x10]
call fcn.0043c924
push dword [esp + 0x34]
lea ecx, [esp + 0x20]
call fcn.00431dfc
test eax, eax
je 0x42e5ad
push dword [0x4ab4f0]
push dword [esp + 0x20]
push str.LastCrashTime
push 0x486104
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp word [esp + 0x1fc], 0
je 0x42dfc6
lea eax, [esp + 0x1fc]
push eax
push str._GLOBALROOT
lea ecx, [esp + 0x5c]
call fcn.0043b487
mov edx, eax
lea ecx, [esp + 0x94]
call fcn.0043ab55
pop ecx
xor ecx, ecx
lea edx, [esp + 0x1e8]
push ecx
mov ecx, dword [eax]
call fcn.0044c96a
pop ecx
mov ecx, dword [esp + 0x90]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov ecx, dword [esp + 0x54]
lea ecx, [ecx - 0x10]
call fcn.0043c924
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
test eax, eax
je 0x42dfe0
lea ecx, [esp + 0x1c8]
mov dword [eax], ecx
xor ecx, ecx
jmp 0x42dfe4
xor ecx, ecx
mov eax, ecx
push ecx
push ecx
push eax
push 0x432be6
push ecx
push ecx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esp + 0x84], eax
call fcn.0043c5cd
push eax
lea ecx, [esp + 0x34]
call fcn.0043ac50
mov edx, str.UpdateInfo_Report
mov ecx, 0x4ab3c0
call fcn.0043a873
mov dword [esp + 0x54], eax
test eax, eax
je 0x42e1fb
push ebx
push 9
push str.MinReport
mov ecx, eax
call fcn.0043a80d
test eax, eax
je 0x42e072
mov eax, dword [eax + 4]
test eax, eax
jne 0x42e047
mov eax, 0x491414
push 0x10
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.msvcrt.dll__wcstoui64]
add esp, 0xc
cmp edx, dword [esp + 0x1dc]
ja 0x42e1fb
jb 0x42e072
cmp eax, dword [esp + 0x1d8]
ja 0x42e1fb
mov ecx, str.dbghelp.dll
call fcn.00481afc
push str.MiniDumpWriteDump
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x90], eax
test eax, eax
je 0x42e1fb
call dword [sym.imp.CBSHost.dll_DismGetScratchDir]
add eax, 8
lea ecx, [esp + 0x30]
push eax
call fcn.0043b8b2
xor eax, eax
push eax
call dword [sym.imp.msvcrt.dll__time64]
pop ecx
push edx
push eax
lea eax, [esp + 0x38]
push str.Dism__I64x_
push eax
call fcn.0043b264
mov esi, dword [esp + 0x40]
add esp, 0x10
xor eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.Dismx86.dmp
lea edx, [esp + 0x34]
lea ecx, [esp + 0x40]
call fcn.0043ab55
mov edi, dword [esp + 0x40]
xor eax, eax
pop ecx
push eax
push 0x80
push 2
push eax
push eax
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x24], eax
cmp eax, 0xffffffff
je 0x42e1d9
mov ecx, dword [esp + 0x54]
push ebx
push 8
push str.DumpType
call fcn.0043a80d
test eax, eax
je 0x42e144
mov eax, dword [eax + 4]
test eax, eax
jne 0x42e133
mov eax, 0x491414
push 0x10
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
jmp 0x42e149
mov eax, 0x401
mov ebx, dword [esp + 0x20]
xor ecx, ecx
push ecx
push ecx
lea ecx, [esp + 0x74]
push ecx
push eax
push dword [esp + 0x34]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push eax
push ebx
call dword [esp + 0xac]
push dword [esp + 0x24]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x42e1d6
push 0x4979bc
lea edx, [esp + 0x34]
lea ecx, [esp + 0x5c]
call fcn.0043ab55
mov edx, 0x4ab30c
mov dword [esp], str.ConfigDism.tmp.log
lea ecx, [esp + 0x2c]
call fcn.0043ab55
mov edi, dword [esp + 0x5c]
xor eax, eax
mov esi, dword [esp + 0x2c]
pop ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi - 0x10]
call fcn.0043c924
lea ecx, [edi - 0x10]
call fcn.0043c924
mov ecx, dword [esp + 0x3c]
lea ecx, [ecx - 0x10]
jmp 0x42e1ee
xor ebx, ebx
inc ebx
mov edx, ebx
mov ecx, esi
call fcn.0044bfcd
lea ecx, [esp + 0x30]
call fcn.0043b7b6
lea ecx, [edi - 0x10]
call fcn.0043c924
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0xc]
push 2
xor ecx, ecx
lea eax, [esp + 0x4c]
push ecx
push ecx
push eax
push 0xffffffffffffffff
push 0x10
push ecx
push dword [edi + 0xc]
mov dword [esp + 0x68], ecx
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x42e23b
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x30]
xor eax, eax
cmp dword [edi - 0xc], eax
je 0x42e58a
call fcn.0043c5cd
push eax
lea ecx, [esp + 0x10]
call fcn.0043ac50
mov ebx, dword [sym.imp.msvcrt.dll_wcslen]
mov esi, str.Dism_Crash_when_UTC_Time
push esi
call ebx
pop ecx
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.0043b96c
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [esp + 0xa0]
push eax
movzx eax, word [esp + 0xa2]
push eax
movzx eax, word [esp + 0xa4]
push eax
movzx eax, word [esp + 0xa6]
push eax
movzx eax, word [esp + 0xa6]
push eax
movzx eax, word [esp + 0xa8]
push eax
lea eax, [esp + 0x24]
push str._hu__.2hu__.2hu__.2hu:_.2hu:_.2hu
push eax
call fcn.0043b264
mov esi, 0x48e1fc
push esi
call ebx
add esp, 0x24
lea ecx, [esp + 0xc]
push eax
push esi
call fcn.0043b96c
mov esi, 0x497a54
push esi
call ebx
pop ecx
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.0043b96c
movzx eax, byte [esp + 0x1d7]
push eax
movzx eax, byte [esp + 0x1da]
push eax
movzx eax, byte [esp + 0x1dd]
push eax
movzx eax, byte [esp + 0x1e0]
push eax
movzx eax, byte [esp + 0x1e3]
push eax
movzx eax, byte [esp + 0x1e6]
push eax
movzx eax, byte [esp + 0x1e9]
push eax
movzx eax, byte [esp + 0x1ec]
push eax
movzx eax, word [esp + 0x1ee]
push eax
movzx eax, word [esp + 0x1f0]
push eax
push dword [esp + 0x1f0]
lea eax, [esp + 0x38]
push str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
push eax
call fcn.0043b264
add esp, 0x34
mov esi, 0x48e1fc
push esi
call ebx
pop ecx
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.0043b96c
mov esi, str.Crash_Module:
push esi
call ebx
pop ecx
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.0043b96c
cmp word [esp + 0x1fc], 0
je 0x42e3f2
lea eax, [esp + 0x1fc]
push eax
call ebx
pop ecx
push eax
lea eax, [esp + 0x200]
push eax
lea ecx, [esp + 0x14]
call fcn.0043b96c
movzx eax, word [esp + 0x1e8]
push eax
movzx eax, word [esp + 0x1ee]
push eax
movzx eax, word [esp + 0x1f4]
push eax
movzx eax, word [esp + 0x1fa]
push eax
lea eax, [esp + 0x1c]
push str.____hu._hu._hu._hu__
push eax
call fcn.0043b264
add esp, 0x18
jmp 0x42e406
mov esi, str.null
push esi
call ebx
pop ecx
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.0043b96c
mov esi, 0x48e1fc
push esi
call ebx
pop ecx
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.0043b96c
movzx eax, word [esp + 0x1d8]
push eax
movzx eax, word [esp + 0x1de]
push eax
movzx eax, word [esp + 0x1e4]
push eax
movzx eax, word [esp + 0x1ea]
push eax
lea eax, [esp + 0x1c]
push str.Dism_Version:__hu._hu._hu._hu_r_n
push eax
call fcn.0043b264
movzx eax, word [esp + 0x1f8]
push eax
movzx eax, word [esp + 0x1fe]
push eax
movzx eax, word [esp + 0x204]
push eax
movzx eax, word [esp + 0x20a]
push eax
lea eax, [esp + 0x34]
push str.OS_Version:__hu._hu._hu._hu_r_n
push eax
call fcn.0043b264
push dword [esp + 0x220]
lea eax, [esp + 0x40]
push str.ExceptionOffset:_0x_.8X_r_n
push eax
call fcn.0043b264
add esp, 0x3c
lea eax, [esp + 0xc]
push dword [esp + 0x1f8]
push str.ExceptionCode:_0x_.8X_r_n
push eax
call fcn.0043b264
mov eax, dword [edi - 0xc]
lea ecx, [esp + 0x3c]
add esp, 0xc
dec eax
push eax
call fcn.0043c894
push 0x491a4c
lea edx, [esp + 0x34]
lea ecx, [esp + 0x54]
call fcn.0043ab55
mov edx, edi
mov ecx, esp
call fcn.00449fb5
mov esi, dword [esp + 0x54]
lea ecx, [esp + 0x3c]
mov edx, esi
call fcn.00449fb5
mov ecx, dword [eax]
call fcn.004108ea
pop ecx
mov ecx, dword [esp + 0x38]
mov ebx, eax
add ecx, 0xfffffff0
call fcn.0043c924
test ebx, ebx
jne 0x42e56a
push str.Dism_Crash_Auto_Report_
lea ecx, [esp + 0x50]
call fcn.0043b487
lea eax, [esp + 0x1fc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [esp + 0x50]
call fcn.0043b9f9
push dword [esp + 0x1f0]
lea eax, [esp + 0x50]
push 0x4978f8
push eax
call fcn.0043b264
mov edx, dword [esp + 0x18]
add esp, 0xc
push esi
mov esi, dword [esp + 0x50]
mov ecx, esi
call fcn.0042cbff
pop ecx
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esi - 0x10]
call fcn.0043c924
mov esi, dword [esp + 0x50]
xor ebx, ebx
mov ecx, edi
lea edx, [ebx + 1]
call fcn.0044bfcd
lea ecx, [esi - 0x10]
call fcn.0043c924
mov ecx, dword [esp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov esi, dword [esp + 0x84]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [edi - 0x10]
call fcn.0043c924
test esi, esi
je 0x42e5ad
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov ecx, dword [esp + 0x34]
lea ecx, [ecx - 0x10]
call fcn.0043c924
jmp 0x42dca2
push str._All
push dword [edi]
xor ebx, ebx
mov dword [0x4aa108], ebx
call esi
mov esi, str._Image
test eax, eax
je 0x42e663
mov ecx, dword [edi]
mov edx, esi
push 6
call fcn.0042cb1b
pop ecx
test al, al
jne 0x42e663
push 0x490d48
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x42e623
push 0x40
push 0x486104
push 0x497ef8
call sym.Dismx86.exe_DismMultiLanguage
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x42eb60
push edi
lea ecx, [esp + 0x144]
call fcn.0040e5cd
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp dword [esp + 0x144], ebx
jne 0x42e646
mov dword [esp + 0x144], eax
push ebx
push ebx
push ebx
lea eax, [esp + 0x14c]
push eax
call dword [sym.imp.COMCTL32.dll_Ordinal_345]
mov ecx, dword [esp + 0x1a8]
jmp 0x42e823
push 6
push esi
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x42e6bb
mov esi, dword [edi]
cmp word [esi + 0xc], bx
jne 0x42e688
push 0x40
push 0x486104
push str._Image:_path_to_image__t_
jmp 0x42e611
add esi, 0xe
cmp word [esi], 0x22
jne 0x42e6a2
add esi, 2
mov ecx, esi
call fcn.0044bc8f
xor ecx, ecx
mov word [esi + eax*2 - 2], cx
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00412aef
mov esi, eax
mov dword [esp + 0x20], esi
test esi, esi
jne 0x42eb2b
mov ecx, dword [edi + 4]
mov edx, str._Plugin
push 7
call fcn.0042cb1b
pop ecx
test al, al
je 0x42e7c7
mov eax, dword [edi + 4]
cmp word [eax + 0xe], bx
jne 0x42e6ed
push 0x40
push 0x486104
push str._Plugin:_Plugin_ID__t_
jmp 0x42e611
push 0x497e48
add eax, 0x10
lea ecx, [esp + 0x5c]
push eax
push str.ConfigPlugins_
mov edx, 0x4ab30c
call fcn.0043ab55
pop ecx
mov edx, eax
lea ecx, [esp + 0x30]
call fcn.0043ab55
pop ecx
mov edx, eax
lea ecx, [esp + 0x3c]
call fcn.0043ab55
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [esp + 0x38]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0043c924
mov ecx, dword [esp + 0x28]
add ecx, 0xfffffff0
call fcn.0043c924
mov ecx, dword [esp + 0x58]
add ecx, 0xfffffff0
call fcn.0043c924
test esi, esi
jne 0x42e762
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 0x20], esi
jmp 0x42e7ba
push str.DismCreateInstance2
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x42e780
mov esi, 0x80004002
mov dword [esp + 0x20], esi
jmp 0x42eb2b
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], ebx
push ecx
push 0x497364
push dword [esp + 0x18]
call eax
mov esi, eax
mov dword [esp + 0x20], esi
test esi, esi
jne 0x42eb2b
mov ecx, dword [esp + 0x34]
lea eax, [edi + 8]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0xc]
mov eax, dword [esp + 0x34]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test esi, esi
je 0x42eb5e
jmp 0x42eb2b
push 0x40
push 0x486104
push 0x497e88
jmp 0x42e611
xor eax, eax
mov dword [0x4aa108], eax
push str.GlobalDism_B8BECCD6_BA05_443C_B649_012B3E5C21E6
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esp + 0x58], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x42e830
mov ebx, 0x420
lea ecx, [esp + 0x38]
mov edx, ebx
call fcn.0043b4b9
push 0x30
push 0x486104
push dword [eax]
xor eax, eax
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x38]
lea ecx, [ecx - 0x10]
call fcn.0043c924
jmp 0x42eb60
mov edx, str.Data_UserAgreement
mov ecx, 0x4ab4f8
call fcn.0043a873
mov edx, eax
test edx, edx
je 0x42e9d1
mov ecx, dword [edx + 4]
lea edi, [esp + 0x6d]
xor eax, eax
mov byte [esp + 0x6c], 0xff
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
test ecx, ecx
je 0x42e866
mov edx, dword [edx + 0xc]
jmp 0x42e86a
xor eax, eax
mov edx, eax
test ecx, ecx
jne 0x42e873
mov ecx, 0x491414
push 0x10
lea eax, [esp + 0x70]
add edx, edx
push eax
push 0x8003
call fcn.0044b2b2
xor eax, eax
lea edi, [esp + 0xa0]
stosd dword es:[edi], eax
lea ecx, [esp + 0xa0]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00470c1e
mov eax, dword [esp + 0x94]
xor dword [esp + 0x6c], eax
mov eax, dword [esp + 0x98]
xor dword [esp + 0x70], eax
mov eax, dword [esp + 0x9c]
xor dword [esp + 0x74], eax
mov eax, dword [esp + 0xa0]
xor dword [esp + 0x78], eax
call fcn.0043c5cd
push eax
lea ecx, [esp + 0x40]
call fcn.0043ac50
mov ecx, dword [0x4ab4f0]
lea eax, [esp + 0x3c]
push eax
mov edi, str.UserAgreement
mov edx, 0x486104
push edi
call fcn.0044d2be
mov esi, dword [esp + 0x44]
mov edx, esi
pop ecx
lea ecx, [esp + 0x70]
call fcn.0043a6bc
pop ecx
test al, al
jne 0x42e9c9
xor eax, eax
push eax
push ecx
push 0x498150
call sym.Dismx86.exe_DismMultiLanguage
push ecx
mov ecx, esp
mov dword [ecx], eax
lea ecx, [esp + 0xcc]
call fcn.00404bb3
lea ecx, [esp + 0x140]
call fcn.0040ebca
lea eax, [esp + 0x160]
push eax
lea ecx, [esp + 0xc4]
call fcn.004307d4
xor eax, eax
lea ecx, [esp + 0xc0]
push eax
call fcn.00430827
cmp eax, ebx
je 0x42e992
cmp dword [esp + 0x154], 0
je 0x42e979
push dword [esp + 0x154]
call fcn.004824c6
lea ecx, [esp + 0xc0]
call fcn.0043088d
lea ecx, [esi - 0x10]
call fcn.0043c924
jmp 0x42eb11
push ecx
mov ecx, dword [0x4ab4f0]
lea eax, [esp + 0x70]
push eax
push edi
call fcn.0044d317
add esp, 0xc
cmp dword [esp + 0x154], 0
je 0x42e9bd
push dword [esp + 0x154]
call fcn.004824c6
lea ecx, [esp + 0xc0]
call fcn.0043088d
lea ecx, [esi - 0x10]
call fcn.0043c924
call sym.Dismx86.exe_BcdIsWinPEBoot
test eax, eax
je 0x42e9e3
xor eax, eax
mov dword [0x4aa12c], eax
jmp 0x42ea30
call fcn.0043c5cd
push eax
lea ecx, [esp + 0x28]
call fcn.0043ac50
mov ecx, dword [0x4ab4f0]
lea eax, [esp + 0x24]
push eax
push str.Mode
mov edx, 0x486104
call fcn.0044d2be
mov esi, dword [esp + 0x2c]
pop ecx
pop ecx
push 0x48e390
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
neg eax
lea ecx, [esi - 0x10]
sbb eax, eax
and dword [0x4aa12c], eax
call fcn.0043c924
call fcn.0042c4fb
push str.ConfigTemp
mov edx, 0x4ab30c
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x3c]
call fcn.0043ab55
pop ecx
mov edx, ebx
mov ecx, dword [eax]
call fcn.0044bfcd
mov ecx, dword [esp + 0x38]
lea ecx, [ecx - 0x10]
call fcn.0043c924
xor ecx, ecx
lea eax, [esp + 0x44]
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push eax
push ecx
push ecx
push ecx
mov esi, 0x80000002
mov dword [esp + 0x70], ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
jmp 0x42eaff
push 0x103
lea ecx, [esp + 0xa3c]
push ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x42eaff
push 0x26
push str.bf1a281b_ad7b_4476_ac95_f47682990ce7
lea eax, [esp + 0xa40]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x42eaff
lea eax, [esp + 0xa38]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
test eax, eax
je 0x42eaff
push eax
lea eax, [esp + 0xa3c]
push eax
lea eax, [esp + 0x30]
push 0x493c2c
push eax
call fcn.00449eea
add esp, 0x10
push dword [eax]
push str.kb__
push ebx
call dword [sym.imp.CBSHost.dll_DismWriteLog]
mov ecx, dword [esp + 0x28]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov eax, dword [esp + 0x44]
dec eax
mov dword [esp + 0x44], eax
cmp eax, 0xffffffff
jne 0x42ea85
mov esi, dword [esp + 0x58]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [esp + 0x24]
jmp 0x42eb60
xor ebx, ebx
mov edx, esi
lea ecx, [esp + 0x54]
call fcn.0043b4b9
push 0x10
push 0x486308
mov esi, eax
call sym.Dismx86.exe_DismMultiLanguage
push eax
push dword [esi]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x54]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov esi, dword [esp + 0x20]
mov ebx, esi
mov ecx, dword [esp + 0x80]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov esi, dword [esp + 0xb0]
mov ecx, dword [esp + 0x18]
lea ecx, [ecx - 0x10]
call fcn.0043c924
lea ecx, [esp + 0x600]
call fcn.0043aa5e
test esi, esi
js 0x42eb98
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x10