Function at 0x420de0
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Delete service
Get common file path
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52f3e8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c4
mov eax, dword [0x57a438]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x4cc], edi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, edi
call fcn.00421e70
push 5
mov ecx, edi
call fcn.00421fc0
mov ecx, edi
call fcn.00422280
push 0xa
mov ecx, edi
call fcn.00421fc0
cmp dword [0x57c0cc], 0
je 0x420f16
push str.ntdll.dll
mov dword [ebp - 0x478], 0
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x480], 0
mov dword [ebp - 0x4d0], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x420f0c
push str.RtlGetNtVersionNumbers
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x420ec5
lea ecx, [ebp - 0x480]
push ecx
lea ecx, [ebp - 0x42c]
push ecx
lea ecx, [ebp - 0x478]
push ecx
call eax
movzx eax, word [ebp - 0x480]
mov dword [ebp - 0x480], eax
mov dword [ebp - 0x4d0], 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x4d0], 0
je 0x420f0c
mov eax, dword [ebp - 0x478]
cmp eax, 6
jne 0x420eeb
cmp dword [ebp - 0x42c], 4
je 0x420ef0
jmp 0x420f0c
cmp eax, 0xa
jb 0x420f0c
mov eax, dword [0x587d64]
mov ecx, 1
cmp dword [ebp - 0x480], 0x55f0
cmovae eax, ecx
mov dword [0x587d64], eax
mov dword [0x57c0cc], 0
cmp dword [0x587d64], 0
je 0x42110a
push 0x17
xor eax, eax
mov dword [ebp - 0x4b8], 0
push str.UninstallerExtInstaller
lea ecx, [ebp - 0x4c8]
mov dword [ebp - 0x4b4], 7
mov word [ebp - 0x4c8], ax
call fcn.0040b2e0
mov dword [ebp - 4], 0
xor eax, eax
mov edx, dword [edi + 0xc]
mov ecx, edx
mov dword [ebp - 0x488], 0
mov dword [ebp - 0x484], 7
mov word [ebp - 0x498], ax
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x420f80
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x498]
call fcn.0040b2e0
push 0x208
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 1
push 0
push eax
call fcn.004fecc0
add esp, 0xc
lea eax, [ebp - 0x498]
cmp dword [ebp - 0x484], 8
cmovae eax, dword [ebp - 0x498]
push str.RegSparsePkg.exe
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
call fcn.00407b40
mov ecx, eax
test ecx, ecx
je 0x421e20
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x42c], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x4c8]
cmp dword [ebp - 0x4b4], 8
cmovae eax, dword [ebp - 0x4c8]
push eax
lea eax, [ebp - 0x42c]
push str._u___msix_name_s
push eax
call fcn.00407210
mov esi, dword [ebp - 0x42c]
add esp, 0xc
mov edx, esi
push 1
push ecx
push 0
sub esp, 0xc
lea ecx, [ebp - 0x21c]
call fcn.0042a4c0
mov byte [ebp - 4], 1
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x421060
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x484]
cmp edx, 8
jb 0x4210a4
mov ecx, dword [ebp - 0x498]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42109a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421e2a
push edx
push ecx
call fcn.004ac6c8
add esp, 8
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x4b4]
mov dword [ebp - 0x488], 0
mov dword [ebp - 0x484], 7
mov word [ebp - 0x498], ax
cmp edx, 8
jb 0x42110f
mov ecx, dword [ebp - 0x4c8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4210fe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421e2f
push edx
push ecx
call fcn.004ac6c8
add esp, 8
jmp 0x42110f
call fcn.00420060
mov edx, dword [edi + 0xc]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x4a0], 0
mov dword [ebp - 0x49c], 7
mov word [ebp - 0x4b0], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421134
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x4b0]
call fcn.0040b2e0
push 5
push str._apps
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 4], 3
call fcn.0040b0f0
push 0xb
push str.clean_core
lea ecx, [ebp - 0x4b0]
call fcn.0040b0f0
call fcn.0040d740
lea ecx, [ebp - 0x4b0]
test eax, eax
je 0x421193
push 0x17
push str.WinOptCleanShell64.dll
jmp 0x42119a
push 0x15
push str.WinOptCleanShell.dll
call fcn.0040b0f0
cmp dword [ebp - 0x49c], 8
lea ecx, [ebp - 0x4b0]
cmovae ecx, dword [ebp - 0x4b0]
call fcn.0041fbe0
mov ecx, edi
call fcn.004232d0
push 0xf
mov ecx, edi
call fcn.00421fc0
lea ecx, [ebp - 0x47c]
call fcn.00426ed0
mov byte [ebp - 4], 4
mov edi, dword [eax]
mov dword [ebp - 0x46c], 0x650072
mov dword [ebp - 0x468], 0x6f006d
mov dword [ebp - 0x464], 0x650076
mov dword [ebp - 0x460], 0x730020
mov dword [ebp - 0x45c], 0x6f0068
mov dword [ebp - 0x458], 0x740072
mov dword [ebp - 0x454], 0x630020
mov dword [ebp - 0x450], 0x740075
mov dword [ebp - 0x44c], 0x260020
mov dword [ebp - 0x448], 0x730020
mov dword [ebp - 0x444], 0x610074
mov dword [ebp - 0x440], 0x740072
mov dword [ebp - 0x43c], 0x6d0020
mov dword [ebp - 0x438], 0x6e0065
mov dword [ebp - 0x434], 0x75
call fcn.00407b40
push eax
push 0x1d
lea eax, [ebp - 0x46c]
push eax
lea ecx, [ebp - 0x42c]
call fcn.004070e0
sub esp, 8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xac]
call fcn.004093f0
mov byte [ebp - 4], 6
mov eax, 0x55fc20
mov esi, dword [ebp - 0x42c]
test esi, esi
cmovne eax, esi
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.00407550
mov eax, dword [edi]
lea ecx, [ebp - 0xac]
add esp, 8
push ecx
mov ecx, edi
call dword [eax + 0xc]
lea ecx, [ebp - 0xac]
call fcn.0040a3e0
lea edx, [esi - 0x10]
mov byte [ebp - 4], 4
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4212f6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov edi, dword [ebp - 0x478]
test edi, edi
je 0x421323
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x421323
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, esi
lock xadd dword [edi + 8], eax
jne 0x421323
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
xorps xmm0, xmm0
mov byte [ebp - 4], 3
movups xmmword [ebp - 0x4c0], xmm0
call fcn.00407b40
mov ecx, eax
test ecx, ecx
je 0x421e34
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4c0], eax
mov byte [ebp - 4], 8
call fcn.0042a6f0
call fcn.0042a980
lea ecx, [ebp - 0x47c]
call fcn.00426ed0
mov byte [ebp - 4], 9
mov edi, dword [eax]
xor eax, eax
mov dword [ebp - 0x474], 0x650072
mov dword [ebp - 0x470], 0x6f006d
mov dword [ebp - 0x46c], 0x650076
mov dword [ebp - 0x468], 0x730020
mov dword [ebp - 0x464], 0x6f0068
mov dword [ebp - 0x460], 0x740072
mov dword [ebp - 0x45c], 0x630020
mov dword [ebp - 0x458], 0x740075
mov dword [ebp - 0x454], 0x260020
mov dword [ebp - 0x450], 0x730020
mov dword [ebp - 0x44c], 0x610074
mov dword [ebp - 0x448], 0x740072
mov dword [ebp - 0x444], 0x6d0020
mov dword [ebp - 0x440], 0x6e0065
mov dword [ebp - 0x43c], 0x2c0075
mov dword [ebp - 0x438], 0x650020
mov dword [ebp - 0x434], 0x64006e
mov word [ebp - 0x430], ax
call fcn.00407b40
push eax
push 0x22
lea eax, [ebp - 0x474]
push eax
lea ecx, [ebp - 0x42c]
call fcn.004070e0
sub esp, 8
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xac]
call fcn.004093f0
mov byte [ebp - 4], 0xb
mov eax, 0x55fc20
mov esi, dword [ebp - 0x42c]
test esi, esi
cmovne eax, esi
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.00407550
mov eax, dword [edi]
lea ecx, [ebp - 0xac]
add esp, 8
push ecx
mov ecx, edi
call dword [eax + 0xc]
lea ecx, [ebp - 0xac]
call fcn.0040a3e0
lea edx, [esi - 0x10]
mov byte [ebp - 4], 9
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4214a9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xc
mov edi, dword [ebp - 0x478]
test edi, edi
je 0x4214d6
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x4214d6
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, esi
lock xadd dword [edi + 8], eax
jne 0x4214d6
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov ecx, dword [ebp - 0x4cc]
push 0x1e
mov byte [ebp - 4], 8
call fcn.00421fc0
xorps xmm0, xmm0
mov dword [ebp - 0x484], 0
movups xmmword [ebp - 0x494], xmm0
call fcn.00407b40
mov ecx, eax
test ecx, ecx
je 0x421e3e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x494], eax
call fcn.00407b40
mov ecx, eax
test ecx, ecx
je 0x421e48
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x488], eax
call fcn.00407b40
mov ecx, eax
test ecx, ecx
je 0x421e52
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x484], eax
lea ecx, [ebp - 0x47c]
mov byte [ebp - 4], 0xd
call fcn.00426ed0
mov byte [ebp - 4], 0xe
mov edi, dword [eax]
xor eax, eax
mov dword [ebp - 0x46c], 0x700075
mov dword [ebp - 0x468], 0x610064
mov dword [ebp - 0x464], 0x650074
mov dword [ebp - 0x460], 0x750020
mov dword [ebp - 0x45c], 0x69006e
mov dword [ebp - 0x458], 0x73006e
mov dword [ebp - 0x454], 0x610074
mov dword [ebp - 0x450], 0x6c006c
mov dword [ebp - 0x44c], 0x730020
mov dword [ebp - 0x448], 0x66006f
mov dword [ebp - 0x444], 0x770074
mov dword [ebp - 0x440], 0x720061
mov dword [ebp - 0x43c], 0x200065
mov dword [ebp - 0x438], 0x6e0069
mov dword [ebp - 0x434], 0x6f0066
mov word [ebp - 0x430], ax
call fcn.00407b40
push eax
push 0x1e
lea eax, [ebp - 0x46c]
push eax
lea ecx, [ebp - 0x42c]
call fcn.004070e0
sub esp, 8
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xac]
call fcn.004093f0
mov byte [ebp - 4], 0x10
mov eax, 0x55fc20
mov esi, dword [ebp - 0x42c]
test esi, esi
cmovne eax, esi
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.00407550
mov eax, dword [edi]
lea ecx, [ebp - 0xac]
add esp, 8
push ecx
mov ecx, edi
call dword [eax + 0xc]
lea ecx, [ebp - 0xac]
call fcn.0040a3e0
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0xe
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42169d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x11
mov edi, dword [ebp - 0x478]
test edi, edi
je 0x4216ca
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x4216ca
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, esi
lock xadd dword [edi + 8], eax
jne 0x4216ca
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov byte [ebp - 4], 0xd
call fcn.0042aed0
mov ecx, dword [ebp - 0x4cc]
push 0x23
call fcn.00421fc0
lea ecx, [ebp - 0x47c]
call fcn.00426ed0
mov byte [ebp - 4], 0x12
mov edi, dword [eax]
mov dword [ebp - 0x464], 0x650064
mov dword [ebp - 0x460], 0x65006c
mov dword [ebp - 0x45c], 0x650074
mov dword [ebp - 0x458], 0x750020
mov dword [ebp - 0x454], 0x69006e
mov dword [ebp - 0x450], 0x73006e
mov dword [ebp - 0x44c], 0x610074
mov dword [ebp - 0x448], 0x6c006c
mov dword [ebp - 0x444], 0x720020
mov dword [ebp - 0x440], 0x670065
mov dword [ebp - 0x43c], 0x690020
mov dword [ebp - 0x438], 0x650074
mov dword [ebp - 0x434], 0x6d
call fcn.00407b40
push eax
push 0x19
lea eax, [ebp - 0x464]
push eax
lea ecx, [ebp - 0x42c]
call fcn.004070e0
sub esp, 8
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xac]
call fcn.004093f0
mov byte [ebp - 4], 0x14
mov eax, 0x55fc20
mov esi, dword [ebp - 0x42c]
test esi, esi
cmovne eax, esi
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.00407550
mov eax, dword [edi]
lea ecx, [ebp - 0xac]
add esp, 8
push ecx
mov ecx, edi
call dword [eax + 0xc]
lea ecx, [ebp - 0xac]
call fcn.0040a3e0
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0x12
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4217fa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x15
mov edi, dword [ebp - 0x478]
test edi, edi
je 0x421827
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x421827
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, esi
lock xadd dword [edi + 8], eax
jne 0x421827
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov byte [ebp - 4], 0xd
call fcn.0042ac20
mov ecx, dword [ebp - 0x4cc]
push 0x28
call fcn.00421fc0
mov dword [ebp - 0x444], 0x690057
mov dword [ebp - 0x440], 0x6f006e
mov dword [ebp - 0x43c], 0x740070
mov dword [ebp - 0x438], 0x760053
mov dword [ebp - 0x434], 0x63
call fcn.00407b40
push eax
push 9
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x42c]
call fcn.004070e0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, dword [ebp - 0x42c]
mov esi, eax
test esi, esi
je 0x421905
push 0xf01ff
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x4218c5
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call eax
jmp 0x421905
lea ecx, [ebp - 0x44c]
mov dword [ebp - 0x434], 0
push ecx
xorps xmm0, xmm0
push 1
push eax
movups xmmword [ebp - 0x44c], xmm0
movq qword [ebp - 0x43c], xmm0
call dword [sym.imp.ADVAPI32.dll_ControlService]
push dword [ebp - 0x42c]
mov eax, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call eax
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x42191d
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x444], 0x690057
mov dword [ebp - 0x440], 0x6f006e
mov dword [ebp - 0x43c], 0x740070
mov dword [ebp - 0x438], 0x760053
mov dword [ebp - 0x434], 0x63
call fcn.00407b40
push eax
push 9
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x42c]
call fcn.004070e0
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
test esi, esi
je 0x4219b2
push 0xf01ff
push dword [ebp - 0x42c]
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x42199f
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x4219b2
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
mov edx, dword [ebp - 0x42c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4219d0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x47c]
call fcn.00426ed0
mov byte [ebp - 4], 0x16
mov edi, dword [eax]
xor eax, eax
mov dword [ebp - 0x44c], 0x650072
mov dword [ebp - 0x448], 0x6f006d
mov dword [ebp - 0x444], 0x650076
mov dword [ebp - 0x440], 0x610020
mov dword [ebp - 0x43c], 0x740075
mov dword [ebp - 0x438], 0x72006f
mov dword [ebp - 0x434], 0x6e0075
mov word [ebp - 0x430], ax
call fcn.00407b40
push eax
push 0xe
lea eax, [ebp - 0x44c]
push eax
lea ecx, [ebp - 0x42c]
call fcn.004070e0
sub esp, 8
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xac]
call fcn.004093f0
mov byte [ebp - 4], 0x18
mov eax, 0x55fc20
mov esi, dword [ebp - 0x42c]
test esi, esi
cmovne eax, esi
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.00407550
mov eax, dword [edi]
lea ecx, [ebp - 0xac]
add esp, 8
push ecx
mov ecx, edi
call dword [eax + 0xc]
lea ecx, [ebp - 0xac]
call fcn.0040a3e0
or edi, 0xffffffff
mov byte [ebp - 4], 0x16
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x421ab7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x19
mov esi, dword [ebp - 0x478]
test esi, esi
je 0x421ae4
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x421ae4
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x421ae4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov esi, dword [ebp - 0x4cc]
mov ecx, esi
mov byte [ebp - 4], 0xd
call fcn.00420bd0
push 0x2d
mov ecx, esi
call fcn.00421fc0
mov ecx, esi
call fcn.004235e0
push 0x20a
lea eax, [ebp - 0x428]
push 0
push eax
call fcn.004fecc0
add esp, 0xc
lea eax, [ebp - 0x428]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.004fecc0
add esp, 0xc
mov dword [ebp - 0x448], 0x690057
xor eax, eax
mov dword [ebp - 0x444], 0x4f006e
mov dword [ebp - 0x440], 0x740070
mov dword [ebp - 0x43c], 0x6d0069
mov dword [ebp - 0x438], 0x7a0069
mov dword [ebp - 0x434], 0x720065
mov word [ebp - 0x430], ax
call fcn.00407b40
push eax
push 0xc
lea eax, [ebp - 0x448]
push eax
lea ecx, [ebp - 0x42c]
call fcn.004070e0
mov esi, dword [ebp - 0x42c]
lea eax, [ebp - 0x428]
push esi
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x421bd5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x421bf1
lea ecx, [ebp - 0x21c]
call fcn.0042bf40
mov esi, dword [ebp - 0x4cc]
mov ecx, esi
push 0x53
call fcn.00421fc0
mov ecx, esi
call fcn.004251d0
push 0x5a
mov ecx, esi
call fcn.00421fc0
mov ecx, esi
call fcn.00422130
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
call dword [sym.imp.ole32.dll_CoUninitialize]
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x478], esp
mov dword [eax + 0x24], 0
mov byte [ebp - 4], 0x1a
xor eax, eax
mov dword [ebp - 0x43c], 0x690066
mov dword [ebp - 0x438], 0x69006e
mov dword [ebp - 0x434], 0x680073
mov word [ebp - 0x430], ax
call fcn.00407b40
push eax
push 6
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x42c]
call fcn.004070e0
mov byte [ebp - 4], 0x1b
mov esi, dword [ebp - 0x42c]
push 0
push 0
push 0
push 0x5602b4
push esi
call fcn.004157c0
mov ecx, eax
mov byte [ebp - 4], 0x1c
call fcn.004aac80
mov byte [ebp - 4], 0xd
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x421cc6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov dword [ebp - 0x438], 0
push eax
push 0x5602b4
lea ecx, [ebp - 0x448]
mov dword [ebp - 0x434], 7
mov word [ebp - 0x448], ax
call fcn.0040b2e0
lea eax, [ebp - 0x448]
mov byte [ebp - 4], 0x1d
push eax
call fcn.004157c0
mov ecx, eax
call fcn.004aa850
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x434]
cmp edx, 8
jb 0x421d4f
mov ecx, dword [ebp - 0x448]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x421d45
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421e5c
push edx
push ecx
call fcn.004ac6c8
add esp, 8
mov byte [ebp - 4], 8
mov eax, edi
mov edx, dword [ebp - 0x484]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x421d70
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x488]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x421d8d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x494]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x421daa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x4c0]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x421dc9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x49c]
cmp edx, 8
jb 0x421e05
mov ecx, dword [ebp - 0x4b0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x421dfb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421e61
push edx
push ecx
call fcn.004ac6c8
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ac694
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00407c80
call fcn.005026a0
call fcn.005026a0
push 0x80004005
call fcn.00407c80
push 0x80004005
call fcn.00407c80
push 0x80004005
call fcn.00407c80
push 0x80004005
call fcn.00407c80
call fcn.005026a0
call fcn.005026a0
int3