Function at 0x4309a0
Capabilities:
Acquire debug privileges
Check if file exists
Copy file
Delete file
Get common file path
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ba88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x10c90
call fcn.00447a40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x48], 0
mov dword [edi + 0x278], 0
mov dword [edi + 0x200], 0
mov eax, dword [ebp + 8]
mov dword [edi + 0x250], eax
push 1
push str.SeDebugPrivilege
call fcn.0042b300
add esp, 8
push dword [edi + 0x298]
call dword [sym.imp.USER32.dll_IsWindow]
push 0x64
push 0
push 0x406
push dword [edi + 0x298]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
call esi
push dword [edi + 0x298]
call dword [sym.imp.USER32.dll_IsWindow]
push 0
push 0
push 0x402
push dword [edi + 0x298]
call esi
xorps xmm0, xmm0
movlpd qword [ebp - 0x114], xmm0
push ecx
mov esi, esp
mov dword [ebp + 8], esp
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Die_Installation_wird_vorbereitet.
call fcn.004054c0
mov dword [ebp - 4], 0
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.00417060
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.00437830
push ecx
mov dword [ebp - 0x1c], esp
mov esi, esp
mov eax, dword [0x476478]
mov dword [esi], eax
mov eax, 0x46155c
shr eax, 0x10
mov dword [ebp - 0x90], eax
test ax, ax
jne 0x430ac2
mov eax, 0x46155c
movzx eax, ax
push eax
mov ecx, esi
call fcn.0041c880
jmp 0x430af5
push 0x46155c
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp + 8], eax
test eax, eax
je 0x430af5
push eax
mov ecx, esi
call fcn.0040a900
test eax, eax
je 0x430af5
mov eax, dword [ebp + 8]
add eax, eax
push eax
push 0x46155c
push dword [esi]
call fcn.004480a0
add esp, 0xc
mov dword [ebp - 4], 2
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.00437830
push ecx
mov esi, esp
mov dword [ebp + 8], esp
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Die_Installation_wurde_gestartet.
call fcn.004054c0
mov dword [ebp - 4], 3
push esi
mov dword [ebp - 4], 0xffffffff
call fcn.00417060
add esp, 0xc
mov dword [ebp - 4], 4
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.00437830
push ecx
mov dword [ebp - 0x1c], esp
mov esi, esp
mov eax, dword [0x476478]
mov dword [esi], eax
cmp word [ebp - 0x90], 0
jne 0x430b77
mov eax, 0x46155c
movzx eax, ax
push eax
mov ecx, esi
call fcn.0041c880
jmp 0x430baa
push 0x46155c
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp + 8], eax
test eax, eax
je 0x430baa
push eax
mov ecx, esi
call fcn.0040a900
test eax, eax
je 0x430baa
mov eax, dword [ebp + 8]
add eax, eax
push eax
push 0x46155c
push dword [esi]
call fcn.004480a0
add esp, 0xc
mov dword [ebp - 4], 5
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.00437830
push ecx
mov dword [ebp - 0x1c], esp
mov esi, esp
mov eax, dword [0x476478]
mov dword [esi], eax
mov ecx, 0x4642c0
mov eax, ecx
shr eax, 0x10
test eax, eax
jne 0x430be7
movzx eax, cx
push eax
mov ecx, esi
call fcn.0041c880
jmp 0x430c1a
push 0x4642c0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp + 8], eax
test eax, eax
je 0x430c1a
push eax
mov ecx, esi
call fcn.0040a900
test eax, eax
je 0x430c1a
mov eax, dword [ebp + 8]
add eax, eax
push eax
push 0x4642c0
push dword [esi]
call fcn.004480a0
add esp, 0xc
mov dword [ebp - 4], 6
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.00437830
push ecx
mov dword [ebp - 0x1c], esp
mov esi, esp
mov eax, dword [0x476478]
mov dword [esi], eax
cmp word [ebp - 0x90], 0
jne 0x430c58
mov eax, 0x46155c
movzx eax, ax
push eax
mov ecx, esi
call fcn.0041c880
jmp 0x430c8b
push 0x46155c
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp + 8], eax
test eax, eax
je 0x430c8b
push eax
mov ecx, esi
call fcn.0040a900
test eax, eax
je 0x430c8b
mov eax, dword [ebp + 8]
add eax, eax
push eax
push 0x46155c
push dword [esi]
call fcn.004480a0
add esp, 0xc
mov dword [ebp - 4], 7
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.00437830
mov dword [ebp - 0x39c], 0
mov dword [ebp - 0x398], 0
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jne 0x430cf2
push str.srclient.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x398], eax
test eax, eax
je 0x430cf2
push str.SRSetRestorePointW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x39c], eax
test eax, eax
je 0x430cf2
call fcn.004188b0
mov dword [ebp - 4], 8
cmp dword [edi + 0x250], 0
je 0x430e17
mov eax, dword [0x476478]
mov dword [ebp - 0xf4], eax
mov byte [ebp - 4], 9
mov dword [ebp - 0xfc], SysReAllocString
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xf0], 0x100
mov dword [ebp - 0xe8], 0
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xfc], reloc.OLEAUT32.dll_SysReAllocString
push 0xf003f
push 1
lea eax, [edi + 0x31c]
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push ecx
call fcn.00409520
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x100]
call fcn.0042b170
lea esi, [edi + 0x254]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.00405440
mov byte [ebp - 4], 0xc
push ecx
mov ecx, esp
mov dword [ebp - 0xa0], esp
push str.InstallLocation
call fcn.00405580
mov byte [ebp - 4], 0xd
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x100]
call fcn.00427880
mov byte [ebp - 4], 0xe
push eax
mov ecx, esi
call fcn.00408f00
mov byte [ebp - 4], 0xa
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x430e03
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x430e03
mov eax, dword [ebp + 8]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x100]
call fcn.00408bd0
jmp 0x4310b6
push ecx
mov esi, esp
mov dword [ebp + 8], esp
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Ein_Systemwiederherstellungspunkt_wird_vorbereitet.
call fcn.004054c0
mov byte [ebp - 4], 0xf
push esi
mov byte [ebp - 4], 8
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 8
mov ecx, edi
call fcn.00437830
push str._....
lea ecx, [ebp - 0x80]
call fcn.004054c0
mov byte [ebp - 4], 0x11
push 0x462dcc
lea ecx, [ebp - 0x84]
call fcn.004054c0
mov byte [ebp - 4], 0x12
push ecx
mov esi, esp
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 0x80]
push eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0xa0], esp
push str.Bitte_warten_Sie
call fcn.004054c0
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x8c]
push eax
mov byte [ebp - 4], 0x12
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x14
push eax
lea eax, [ebp - 0x84]
push eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0xa0], esp
push str.Ein_Systemwiederherstellungspunkt_wird_erstellt.
call fcn.004054c0
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x88]
push eax
mov byte [ebp - 4], 0x14
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp + 8]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x18
push eax
push esi
call fcn.004093a0
mov byte [ebp - 4], 0x19
mov byte [ebp - 4], 0x18
mov ecx, edi
call fcn.00437830
mov byte [ebp - 4], 0x17
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x20]
or esi, 0xffffffff
cmp ecx, dword [0x476474]
je 0x430f4a
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x430f4a
mov eax, dword [ebp + 8]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x60]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x430f79
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x430f79
mov eax, dword [ebp - 0x60]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x88]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x430fae
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x430fae
mov eax, dword [ebp - 0x88]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x8c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x430fe3
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x430fe3
mov eax, dword [ebp - 0x8c]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x84]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x43100f
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x43100f
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x431038
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x431038
push ecx
call fcn.004471aa
add esp, 4
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push eax
mov ecx, edi
call fcn.00416fc0
mov byte [ebp - 4], 0x1a
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x5b8]
call fcn.0040ae50
push ecx
mov esi, esp
mov dword [ebp + 8], esp
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
test eax, eax
je 0x43108c
push str.Systemwiederherstellungspunkt_wurde_erfolgreich_erstellt.
call fcn.004054c0
mov byte [ebp - 4], 0x1b
push esi
mov byte [ebp - 4], 8
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x1c
jmp 0x4310ab
push str.Das_Erstellen_eines_Systemwiederherstellungspunkts_hat_nicht_funktioniert.
call fcn.004054c0
mov byte [ebp - 4], 0x1d
push esi
mov byte [ebp - 4], 8
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x1e
mov byte [ebp - 4], 8
mov ecx, edi
call fcn.00437830
push 0
lea eax, [ebp - 0x9c]
push eax
call fcn.004166c0
add esp, 8
mov byte [ebp - 4], 0x1f
push 0
lea ecx, [ebp - 0x9c]
call fcn.00425ea0
mov eax, dword [edi + 0x254]
cmp dword [eax - 8], 0
jne 0x431136
push 0
lea eax, [ebp + 8]
push eax
call fcn.004166c0
add esp, 8
mov byte [ebp - 4], 0x20
push eax
lea ecx, [edi + 0x254]
call fcn.00408f00
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x20]
or esi, 0xffffffff
cmp ecx, dword [0x476474]
je 0x431139
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x431139
mov eax, dword [ebp + 8]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
jmp 0x431139
or esi, 0xffffffff
push 0x11c
push 0
lea eax, [ebp - 0x6d4]
push eax
call fcn.004486f0
add esp, 0xc
mov dword [ebp - 0x6d4], 0x11c
lea eax, [ebp - 0x6d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea ecx, [edi + 0x270]
mov eax, dword [ecx]
test eax, eax
jne 0x43117a
mov dword [ebp - 0xcc], eax
jmp 0x431187
mov eax, dword [eax + 4]
mov dword [ebp - 0xcc], eax
test eax, eax
jne 0x43119e
push 0
push 0
push str.uNumChilds0
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [edi + 0x270]
xor eax, eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xcc], eax
jbe 0x43183a
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.0043ee30
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x64]
mov esi, dword [0x476478]
mov dword [ebp - 0x5c], esi
test eax, eax
jne 0x4311d8
mov dword [ebp - 0x78], esi
jmp 0x431260
mov ecx, dword [eax]
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], esi
test ecx, ecx
je 0x431260
mov eax, ecx
shr eax, 0x10
test eax, eax
jne 0x431201
movzx eax, cx
push eax
lea ecx, [ebp - 0x78]
call fcn.0041c880
mov esi, dword [ebp - 0x78]
mov dword [ebp - 0x5c], esi
jmp 0x431260
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x431260
lea ecx, [eax*2 + 0x22]
push ecx
call fcn.004451f4
add esp, 4
test eax, eax
je 0x431260
mov dword [eax], 1
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov word [eax + ecx*2 + 0x20], dx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0xc], edx
mov dword [eax + 8], edx
mov dword [eax + 4], edx
mov dword [eax + 0x10], edx
add eax, 0x20
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x78], eax
add ecx, ecx
push ecx
push dword [ebp - 0x74]
push eax
call fcn.004480a0
add esp, 0xc
mov esi, dword [ebp - 0x5c]
mov byte [ebp - 4], 0x22
push str.RegSvr32
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4317d5
mov eax, dword [ebp - 0x64]
test eax, eax
jne 0x43128c
mov eax, dword [0x476478]
mov dword [ebp + 8], eax
jmp 0x43133a
xor edi, edi
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x2c], ecx
mov esi, dword [eax + 0x28]
test ecx, ecx
jle 0x4312bc
jmp 0x4312a0
push str.File
push dword [esi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x4312e1
add esi, 8
inc edi
cmp edi, dword [ebp - 0x2c]
jl 0x4312a0
xor esi, esi
mov eax, dword [0x476478]
mov dword [ebp + 8], eax
test esi, esi
je 0x43133a
mov eax, esi
shr eax, 0x10
test eax, eax
jne 0x4312e6
movzx eax, si
push eax
lea ecx, [ebp + 8]
call fcn.0041c880
jmp 0x43133a
mov esi, dword [esi + 4]
jmp 0x4312be
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test edi, edi
je 0x43133a
lea ecx, [edi*2 + 0x22]
push ecx
call fcn.004451f4
add esp, 4
test eax, eax
je 0x43133a
mov dword [eax], 1
xor ecx, ecx
mov word [eax + edi*2 + 0x20], cx
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], edi
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0x10], ecx
add eax, 0x20
mov dword [ebp + 8], eax
lea ecx, [edi + edi]
push ecx
push esi
push eax
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 0x23
mov eax, dword [ebp - 0x64]
test eax, eax
jne 0x431353
mov edi, dword [0x476478]
mov dword [ebp - 0x38], edi
jmp 0x431404
xor edi, edi
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x2c], ecx
mov esi, dword [eax + 0x28]
test ecx, ecx
jle 0x43137e
push str.Parameter
push dword [esi]
call fcn.00446ab0
add esp, 8
test eax, eax
je 0x4313a7
add esi, 8
inc edi
cmp edi, dword [ebp - 0x2c]
jl 0x431362
xor esi, esi
mov edi, dword [0x476478]
mov dword [ebp - 0x38], edi
test esi, esi
je 0x431404
mov eax, esi
shr eax, 0x10
test eax, eax
jne 0x4313ac
movzx eax, si
push eax
lea ecx, [ebp - 0x38]
call fcn.0041c880
mov edi, dword [ebp - 0x38]
jmp 0x431404
mov esi, dword [esi + 4]
jmp 0x431380
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x431404
lea ecx, [eax*2 + 0x22]
push ecx
call fcn.004451f4
add esp, 4
test eax, eax
je 0x431404
mov dword [eax], 1
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov word [eax + ecx*2 + 0x20], dx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0xc], edx
mov dword [eax + 8], edx
mov dword [eax + 4], edx
mov dword [eax + 0x10], edx
lea edi, [eax + 0x20]
mov dword [ebp - 0x38], edi
lea eax, [ecx + ecx]
push eax
push esi
push edi
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 0x24
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.00411850
mov esi, dword [0x476478]
mov dword [ebp - 0x50], esi
mov byte [ebp - 4], 0x25
mov eax, dword [0x476478]
mov dword [ebp - 0x98], eax
mov byte [ebp - 4], 0x26
mov ecx, 0x104
mov dword [ebp - 0x60], ecx
lea eax, [esi - 0x20]
mov dword [ebp - 0x8c], eax
cmp dword [eax], 1
jg 0x43144f
cmp dword [esi - 0xc], ecx
jge 0x4314fc
mov eax, dword [esi - 8]
mov dword [ebp - 0x88], eax
cmp eax, 0x104
jle 0x431473
mov ecx, eax
mov dword [ebp - 0x60], ecx
test eax, eax
jne 0x431473
mov esi, dword [0x476478]
mov dword [ebp - 0x50], esi
jmp 0x4314b5
lea eax, [ecx*2 + 0x22]
push eax
call fcn.004451f4
add esp, 4
test eax, eax
je 0x431500
mov dword [eax], 1
xor edx, edx
mov ecx, dword [ebp - 0x60]
mov word [eax + ecx*2 + 0x20], dx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0xc], edx
mov dword [eax + 8], edx
mov dword [eax + 4], edx
mov dword [eax + 0x10], edx
lea esi, [eax + 0x20]
mov dword [ebp - 0x50], esi
mov eax, dword [ebp - 0x88]
lea eax, [eax*2 + 2]
push eax
mov eax, dword [ebp - 0x8c]
add eax, 0x20
push eax
push esi
call fcn.004480a0
add esp, 0xc
mov eax, dword [ebp - 0x88]
mov dword [esi - 8], eax
mov ecx, dword [ebp - 0x8c]
cmp ecx, dword [0x476474]
je 0x4314fc
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4314fc
push ecx
call fcn.004471aa
add esp, 4
mov eax, esi
jmp 0x431502
xor eax, eax
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [esi - 8], eax
push str.System32
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x27
push eax
lea ecx, [ebp - 0x98]
call fcn.00408f00
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x84]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x431573
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x431573
mov eax, dword [ebp - 0x84]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov dword [ebp - 0x2c0], 0
push 0x44
push 0
lea eax, [ebp - 0x314]
push eax
call fcn.004486f0
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x2d0], xmm0
mov dword [ebp - 0x314], 0x44
add esp, 8
mov dword [ebp - 0x1c], esp
mov ecx, esp
mov dword [ebp - 0x60], ecx
mov eax, dword [0x476478]
mov dword [ecx], eax
cmp word [ebp - 0x90], 0
jne 0x4315ce
mov eax, 0x46155c
movzx eax, ax
push eax
call fcn.0041c880
jmp 0x431605
push 0x46155c
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x431605
push eax
mov ecx, dword [ebp - 0x60]
call fcn.0040a900
test eax, eax
je 0x431605
mov eax, dword [ebp - 0x2c]
add eax, eax
push eax
push 0x46155c
mov eax, dword [ebp - 0x60]
push dword [eax]
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 0x28
lea eax, [ebp - 0x38]
push eax
push str.__u__s
lea eax, [ebp - 0xa8]
push eax
call fcn.00409520
mov byte [ebp - 4], 0x29
push 0x464480
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x2a
lea ecx, [ebp + 8]
push ecx
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x2b
push ecx
mov ecx, esp
mov dword [ebp - 0xa0], esp
push 0x4627a0
push eax
push ecx
call fcn.00409410
mov byte [ebp - 4], 0x2c
push ecx
mov eax, esp
mov dword [ebp - 0x134], esp
push str._regsvr32.exe
lea ecx, [ebp - 0x98]
push ecx
push eax
call fcn.00409410
mov byte [ebp - 4], 0x2d
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x314]
call fcn.0040d280
mov byte [ebp - 4], 0x2f
mov eax, dword [ebp - 0x80]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x4316c1
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4316c1
mov eax, dword [ebp - 0x80]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x2e
mov eax, dword [ebp - 0xa4]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x4316f7
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4316f7
mov eax, dword [ebp - 0xa4]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0xa8]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x43172d
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x43172d
mov eax, dword [ebp - 0xa8]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x25
mov eax, dword [ebp - 0x98]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x43175a
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x43175a
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x24
lea eax, [esi - 0x20]
cmp eax, dword [0x476474]
je 0x431781
add esi, 0xffffffe0
or eax, 0xffffffff
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x431781
push esi
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x23
lea eax, [edi - 0x20]
cmp eax, dword [0x476474]
je 0x4317a8
add edi, 0xffffffe0
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x4317a8
push edi
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x22
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x4317d2
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4317d2
push ecx
call fcn.004471aa
add esp, 4
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x64]
push eax
mov ecx, edi
call fcn.0041c620
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x5c]
lea ecx, [eax - 0x20]
or esi, 0xffffffff
cmp ecx, dword [0x476474]
je 0x43180c
lea ecx, [eax - 0x20]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x43180c
push ecx
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x1f
push dword [ebp - 0x64]
call fcn.0043d220
add esp, 4
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp eax, dword [ebp - 0xcc]
lea ecx, [edi + 0x270]
jb 0x4311b2
lea ecx, [edi + 0x158]
call fcn.0042b820
xor eax, eax
mov dword [ebp - 0x50], eax
cmp eax, dword [ebp - 0xcc]
jae 0x433d7d
cmp dword [edi + 0x200], 0
je 0x4318cf
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x9c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x431892
add eax, 0xffffffe0
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x431892
mov eax, dword [ebp - 0x9c]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x398]
test eax, eax
je 0x4318b4
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x398], 0
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov byte [ebp - 4], 0x31
push dword [edi + 0x298]
call dword [sym.imp.USER32.dll_IsWindow]
mov esi, dword [ebp - 0x50]
test eax, eax
je 0x431900
lea eax, [esi + 1]
imul eax, eax, 0x64
xor edx, edx
div dword [ebp - 0xcc]
push eax
lea ecx, [edi + 0x294]
call fcn.0042b2d0
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [edi + 0x270]
call fcn.0043ee30
mov byte [ebp - 4], 0x32
mov eax, dword [0x476478]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0x33
mov eax, dword [0x476478]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0x34
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x431938
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x30]
call fcn.00405580
mov byte [ebp - 4], 0x35
push str.False
lea ecx, [ebp - 0x248]
call fcn.00405580
mov byte [ebp - 4], 0x36
push eax
push 0
push 0x4644c0
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
call fcn.004090d0
xor ecx, ecx
test al, al
setne cl
mov dword [ebp + 8], ecx
mov dword [ebp - 0x2a8], ecx
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x248]
call fcn.004087b0
push 0
push str.InstallerArch
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x40]
call fcn.00405580
mov byte [ebp - 4], 0x37
mov esi, dword [ebp - 0x40]
cmp dword [esi - 8], 0
je 0x431a1e
push 0x463eec
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x431a12
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x40]
call fcn.004087b0
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x30]
call fcn.004087b0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x28]
call fcn.004087b0
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x24]
call fcn.004087b0
mov byte [ebp - 4], 0x31
push dword [ebp - 0x14]
call fcn.0043d220
add esp, 4
mov byte [ebp - 4], 0x1f
or esi, 0xffffffff
mov eax, dword [ebp - 0x50]
inc eax
jmp 0x431847
push 0x463ef4
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
push 0
push str.OnlyIfOS
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x28]
call fcn.00409040
mov esi, dword [ebp - 0x28]
cmp dword [esi - 8], 0
je 0x431a79
push 0x463eec
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x431a5c
cmp dword [edi + 0x274], 1
jne 0x4319c3
push 0x463ef4
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x431a79
cmp dword [edi + 0x274], 1
je 0x4319c3
push 0
push str.OSType
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x28]
call fcn.00409040
mov esi, dword [ebp - 0x28]
cmp dword [esi - 8], 0
jle 0x431ad7
push str.Server
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x431ab7
call fcn.0041a5c0
test eax, eax
je 0x4319c3
push str.Client
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call esi
test eax, eax
jne 0x431add
call fcn.0041a5c0
test eax, eax
je 0x431add
jmp 0x4319c3
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0
push 0x464528
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x28]
call fcn.00409040
mov eax, dword [ebp - 0x28]
cmp dword [eax - 8], 0
je 0x431b0e
push str.install
push eax
call esi
test eax, eax
jne 0x4319c3
push str.File
mov edi, dword [ebp - 0x30]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x432682
mov byte [ebp - 4], 0x38
push eax
push str.OsVersionMajor
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x58]
call fcn.00405580
mov byte [ebp - 4], 0x39
push dword [ebp - 0x58]
call fcn.0043a8d0
add esp, 4
test eax, eax
je 0x431bb9
cmp eax, dword [ebp - 0x6d0]
je 0x431bb9
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x58]
call fcn.004087b0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x40]
call fcn.004087b0
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x30]
call fcn.004087b0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x28]
call fcn.004087b0
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x24]
call fcn.004087b0
mov byte [ebp - 4], 0x31
push dword [ebp - 0x14]
call fcn.0043d220
add esp, 4
mov byte [ebp - 4], 0x1f
mov edi, dword [ebp - 0x18]
or esi, 0xffffffff
mov eax, dword [ebp - 0x50]
inc eax
jmp 0x431847
push 0
push str.OsVersionMinor
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x68]
call fcn.00405580
mov byte [ebp - 4], 0x3a
mov esi, dword [ebp - 0x68]
push esi
call fcn.0043a8d0
add esp, 4
cmp dword [esi - 8], 0
je 0x431c00
cmp eax, dword [ebp - 0x6cc]
je 0x431c00
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x68]
call fcn.004087b0
jmp 0x431b5b
push 0
push str.Source
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x4c]
call fcn.00405580
mov byte [ebp - 4], 0x3b
push 0
push str.Destination
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x34]
call fcn.00405580
mov byte [ebp - 4], 0x3c
push 0
push str.Type
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x6c]
call fcn.00405580
mov byte [ebp - 4], 0x3d
push 0
push 0x464580
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x70]
call fcn.00405580
mov byte [ebp - 4], 0x3e
push 0
push str.Crc32
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x7c]
call fcn.00405580
mov byte [ebp - 4], 0x3f
push 0
push dword [ebp - 0x7c]
call fcn.0040cf00
add esp, 8
push dword [ebp - 0x4c]
call fcn.0043a8d0
add esp, 4
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x188]
call fcn.00404ef0
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x100]
call fcn.00404ef0
mov byte [ebp - 4], 0x41
mov esi, dword [ebp - 0x18]
mov ecx, dword [esi + 0x290]
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], ecx
mov byte [ebp - 4], 0x42
cmp dword [esi + 0x334], 0
je 0x431e2c
push 0
lea eax, [ebp - 0x188]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x54], esp
lea eax, [ebp - 0x4c]
push eax
call fcn.00405440
mov byte [ebp - 4], 0x43
mov byte [ebp - 4], 0x42
mov ecx, dword [esi + 0x334]
call fcn.00412110
mov dword [ebp - 0x54], eax
test eax, eax
je 0x4320f8
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0xc0]
call fcn.004085e0
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x100]
call fcn.00407f90
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x188]
call fcn.00407f90
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x7c]
call fcn.004087b0
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x70]
call fcn.004087b0
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x6c]
call fcn.004087b0
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x34]
call fcn.004087b0
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x4c]
call fcn.004087b0
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x68]
call fcn.004087b0
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x58]
call fcn.004087b0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x40]
call fcn.004087b0
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x30]
call fcn.004087b0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x28]
call fcn.004087b0
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x24]
call fcn.004087b0
mov byte [ebp - 4], 0x31
push dword [ebp - 0x14]
call fcn.0043d220
add esp, 4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x9c]
call fcn.004087b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5b8]
call fcn.004087e0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 0x54]
push 0x97
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0xc0]
call fcn.0041ab30
test eax, eax
je 0x431e8a
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x188]
push eax
call fcn.0041e0e0
add esp, 8
test eax, eax
jne 0x4320f8
lea ecx, [ebp - 0x100]
call fcn.004092c0
push eax
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x188]
call fcn.0040cfe0
jmp 0x4320f8
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x1f4]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x44
push str..dat
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x45
mov edx, dword [eax]
mov ecx, dword [edx - 8]
add ecx, ecx
mov dword [edx - 4], ecx
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x268]
call fcn.004087b0
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x1f4]
call fcn.004087b0
test esi, esi
je 0x4325c2
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x1fc]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x46
push ecx
mov ecx, esp
mov dword [ebp - 0x54], esp
push str..dat
push eax
push ecx
call fcn.00409410
mov byte [ebp - 4], 0x47
mov byte [ebp - 4], 0x46
call fcn.0041acd0
add esp, 8
mov esi, eax
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x1fc]
call fcn.004087b0
test esi, esi
je 0x4320f5
cmp dword [ebp + 8], 0
je 0x431fd2
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0xc0]
call fcn.004085e0
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x100]
call fcn.00407f90
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x188]
call fcn.00407f90
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x7c]
call fcn.004087b0
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x70]
call fcn.004087b0
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x6c]
call fcn.004087b0
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x34]
call fcn.004087b0
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x4c]
call fcn.004087b0
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x68]
call fcn.004087b0
jmp 0x431b5b
push 2
lea eax, [ebp - 0x240]
push eax
call fcn.00428530
add esp, 8
mov byte [ebp - 4], 0x48
push 0x4615dc
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x34]
push ecx
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x4a
push eax
lea ecx, [ebp - 0x24]
call fcn.00408f00
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x204]
call fcn.004087b0
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x238]
call fcn.004087b0
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x240]
call fcn.004087b0
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
lea eax, [ebp - 0x24]
push eax
call fcn.00405440
mov byte [ebp - 4], 0x4b
mov byte [ebp - 4], 0x42
mov edi, dword [ebp - 0x18]
mov ecx, edi
call fcn.00437830
inc dword [edi + 0x310]
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0xc0]
call fcn.004085e0
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x100]
call fcn.00407f90
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x188]
call fcn.00407f90
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x7c]
call fcn.004087b0
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x70]
call fcn.004087b0
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x6c]
call fcn.004087b0
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x34]
call fcn.004087b0
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x4c]
call fcn.004087b0
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x68]
call fcn.004087b0
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x58]
call fcn.004087b0
jmp 0x4319c3
mov esi, dword [ebp - 0x18]
mov eax, dword [0x476478]
mov dword [ebp - 0xc4], eax
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0x188]
call fcn.00416f90
push edx
push eax
lea ecx, [ebp - 0xc4]
call fcn.00413e50
lea ecx, [ebp - 0x188]
call fcn.00416f90
add dword [ebp - 0x114], eax
adc dword [ebp - 0x110], edx
lea eax, [ebp - 0x34]
push eax
mov ecx, esi
call fcn.00411850
mov eax, dword [0x476478]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 4], 0x52
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00416da0
add esp, 8
lea ecx, [ebp - 0xb4]
call fcn.00425f70
push str.True
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x43218f
lea eax, [ebp - 0x34]
push eax
lea ecx, [esi + 0x26c]
call fcn.00408f00
call fcn.0041a010
test eax, eax
je 0x4321b3
push 0x463eec
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4321b3
push eax
call fcn.00438c90
add esp, 4
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0xc8]
call fcn.00405440
mov byte [ebp - 4], 0x53
mov byte [ebp - 4], 0x57
xor eax, eax
mov dword [ebp - 0x124], eax
mov esi, dword [ebp - 0x34]
cmp eax, 0x32
jge 0x432235
push ecx
mov eax, esp
mov dword [ebp - 0x54], esp
push eax
lea ecx, [ebp - 0xc8]
call fcn.00416980
mov byte [ebp - 4], 0x58
mov byte [ebp - 4], 0x57
call fcn.00435680
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi - 8]
add eax, eax
mov dword [esi - 4], eax
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esi - 8]
add eax, eax
mov dword [esi - 4], eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x432235
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
jmp 0x4321d5
lea ecx, [ebp - 0x2a4]
call fcn.00405a70
mov byte [ebp - 4], 0x59
mov eax, dword [esi - 8]
add eax, eax
mov dword [esi - 4], eax
push 1
push 0xc0000000
push 1
push esi
lea ecx, [ebp - 0x2a4]
call fcn.0040d480
lea eax, [ebp - 0x188]
push eax
lea ecx, [ebp - 0x2a4]
call fcn.00438d60
mov esi, eax
lea ecx, [ebp - 0x188]
call fcn.00416f90
xor ecx, ecx
cmp esi, eax
jne 0x432450
cmp ecx, edx
jne 0x432450
lea ecx, [ebp - 0x2a4]
call fcn.0040cc70
call fcn.0041a010
test eax, eax
je 0x4322c2
push 0x463eec
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4322c2
push 1
call fcn.00438c90
add esp, 4
cmp dword [ebp + 8], 0
jne 0x432384
mov eax, dword [ebp - 0x44]
cmp dword [eax - 8], 0
jne 0x432384
push 0x4645e4
lea ecx, [ebp - 0x13c]
call fcn.004054c0
mov byte [ebp - 4], 0x60
push ecx
mov esi, esp
mov dword [ebp + 8], esp
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x13c]
push eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.Datei_erfolgreich_extrahiert_und_ins_Ziel_kopiert
call fcn.004054c0
mov byte [ebp - 4], 0x61
lea eax, [ebp - 0x18c]
push eax
mov byte [ebp - 4], 0x60
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x62
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x63
push eax
push esi
call fcn.004093a0
mov byte [ebp - 4], 0x64
mov byte [ebp - 4], 0x63
mov esi, dword [ebp - 0x18]
mov ecx, esi
call fcn.00437830
mov byte [ebp - 4], 0x62
lea ecx, [ebp - 0x250]
call fcn.004087b0
mov byte [ebp - 4], 0x60
lea ecx, [ebp - 0x18c]
call fcn.004087b0
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x13c]
call fcn.004087b0
jmp 0x432387
mov esi, dword [ebp - 0x18]
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0x2a4]
call fcn.00408b20
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0xc8]
call fcn.00408340
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0xb4]
call fcn.004087b0
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0xc4]
call fcn.004087b0
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0xc0]
call fcn.004085e0
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x100]
call fcn.00407f90
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x188]
call fcn.00407f90
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x7c]
call fcn.004087b0
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x70]
call fcn.004087b0
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x6c]
call fcn.004087b0
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x34]
call fcn.004087b0
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x4c]
call fcn.004087b0
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x68]
call fcn.004087b0
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x58]
call fcn.004087b0
mov dword [ebp - 4], 0x37
jmp 0x432685
cmp dword [ebp + 8], ecx
je 0x432496
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0x2a4]
call fcn.00408b20
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0xc8]
call fcn.00408340
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0xb4]
call fcn.004087b0
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0xc4]
call fcn.004087b0
jmp 0x431f58
push str.MountShellEx
lea ecx, [ebp - 0x34]
call fcn.00412770
test eax, eax
jns 0x432455
push 0x4645e4
lea ecx, [ebp - 0x12c]
call fcn.004054c0
mov byte [ebp - 4], 0x5a
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x12c]
push eax
push 1
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push str.Fehler_beim_Schreiben_der_Datei_auf_die_Festplatte
call fcn.004054c0
mov byte [ebp - 4], 0x5b
lea eax, [ebp - 0x214]
push eax
mov byte [ebp - 4], 0x5a
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x5c
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x5d
push eax
lea eax, [ebp - 0x25c]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x5e
push eax
lea ecx, [ebp - 0x24]
call fcn.00408f00
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x25c]
call fcn.004087b0
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x258]
call fcn.004087b0
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x214]
call fcn.004087b0
mov byte [ebp - 4], 0x59
lea ecx, [ebp - 0x12c]
call fcn.004087b0
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
lea eax, [ebp - 0x24]
push eax
call fcn.00405440
mov byte [ebp - 4], 0x5f
mov byte [ebp - 4], 0x59
mov edi, dword [ebp - 0x18]
mov ecx, edi
call fcn.00437830
inc dword [edi + 0x310]
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0x2a4]
call fcn.00408b20
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0xc8]
call fcn.00408340
mov byte [ebp - 4], 0x51
lea ecx, [ebp - 0xb4]
call fcn.004087b0
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0xc4]
call fcn.004087b0
jmp 0x43206f
cmp dword [ebp + 8], 0
jne 0x431f58
lea eax, [ebp - 0x34]
push eax
push 0x464594
push 1
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push str.Fehler_beim_Laden_der_Datei_aus_dem_Archiv
call fcn.004054c0
mov byte [ebp - 4], 0x4c
lea eax, [ebp - 0x1a0]
push eax
mov byte [ebp - 4], 0x42
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x4d
push eax
lea eax, [ebp - 0x244]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x4e
push eax
lea eax, [ebp - 0x198]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x4f
push eax
lea ecx, [ebp - 0x24]
call fcn.00408f00
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x198]
call fcn.004087b0
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x244]
call fcn.004087b0
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x1a0]
call fcn.004087b0
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
lea eax, [ebp - 0x24]
push eax
call fcn.00405440
mov byte [ebp - 4], 0x50
jmp 0x43205b
mov esi, dword [ebp - 0x18]
push str.Registry
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x432b04
push eax
push str.Root
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x120]
call fcn.00405580
mov byte [ebp - 4], 0x66
push 0
push str.Type
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x11c]
call fcn.00405580
mov byte [ebp - 4], 0x67
push 0
push 0x463c00
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0xac]
call fcn.00405580
mov byte [ebp - 4], 0x68
push 0
push str.Name
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x78]
call fcn.00405580
mov byte [ebp - 4], 0x69
push 0
push str.DeleteEntry
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x104]
call fcn.00405580
mov byte [ebp - 4], 0x6a
push 0
push str.DeleteKey
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x108]
call fcn.00405580
mov byte [ebp - 4], 0x6b
push 0
push str.Value
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0xb0]
call fcn.00405580
mov byte [ebp - 4], 0x6c
lea eax, [ebp - 0xb0]
push eax
mov ecx, esi
call fcn.00411850
push str.HKLM
mov esi, dword [ebp - 0x120]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
mov eax, dword [ebp - 0x10c]
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
cmove eax, ecx
mov dword [ebp - 0x10c], eax
push str.HKCU
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
mov esi, dword [ebp - 0x10c]
mov eax, SysReAllocString
cmove esi, eax
mov dword [ebp - 0x10c], esi
push eax
lea ecx, [ebp - 0x288]
call fcn.00405ae0
mov byte [ebp - 4], 0x6d
push esi
lea ecx, [ebp - 0x288]
call fcn.0042b3a0
test eax, eax
je 0x43299f
push 0xf003f
push 1
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
lea eax, [ebp - 0xac]
push eax
call fcn.00405440
mov byte [ebp - 4], 0x6e
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x288]
call fcn.0042b170
test eax, eax
je 0x43296e
push str.DWORD
mov esi, dword [ebp - 0x11c]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x432865
push dword [ebp - 0xb0]
call fcn.0043a8d0
add esp, 4
push eax
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
lea eax, [ebp - 0x78]
push eax
call fcn.00405440
mov byte [ebp - 4], 0x6f
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x288]
call fcn.004390e0
push str.String
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4328ad
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
lea eax, [ebp - 0xb0]
push eax
call fcn.00405440
mov byte [ebp - 4], 0x70
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
lea eax, [ebp - 0x78]
push eax
call fcn.00405440
mov byte [ebp - 4], 0x71
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x288]
call fcn.00439580
push str.ExpandString
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4328f5
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
lea eax, [ebp - 0xb0]
push eax
call fcn.00405440
mov byte [ebp - 4], 0x72
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
lea eax, [ebp - 0x78]
push eax
call fcn.00405440
mov byte [ebp - 4], 0x73
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x288]
call fcn.00439180
push str.MultiString
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x43293d
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
lea eax, [ebp - 0xb0]
push eax
call fcn.00405440
mov byte [ebp - 4], 0x74
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
lea eax, [ebp - 0x78]
push eax
call fcn.00405440
mov byte [ebp - 4], 0x75
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x288]
call fcn.00439320
mov eax, dword [ebp - 0x104]
cmp dword [eax - 8], 0
je 0x43296e
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
lea eax, [ebp - 0x104]
push eax
call fcn.00405440
mov byte [ebp - 4], 0x76
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x288]
call fcn.0040f860
mov eax, dword [ebp - 0x108]
cmp dword [eax - 8], 0
je 0x43299f
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
lea eax, [ebp - 0x108]
push eax
call fcn.00405440
mov byte [ebp - 4], 0x77
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x288]
call fcn.0040f770
push str.False
lea ecx, [ebp - 0x21c]
call fcn.00405580
mov byte [ebp - 4], 0x78
push eax
push 0
push 0x4644c0
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
call fcn.004090f0
mov byte [ebp + 0xb], al
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x21c]
call fcn.004087b0
cmp byte [ebp + 0xb], 0
je 0x432a8f
push 0x4645e4
lea ecx, [ebp - 0x118]
call fcn.004054c0
mov byte [ebp - 4], 0x79
push ecx
mov esi, esp
mov dword [ebp + 8], esp
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x118]
push eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.Eintrag_in_der_Registry_erfolgreich_ausgef
call fcn.004054c0
mov byte [ebp - 4], 0x7a
lea eax, [ebp - 0x260]
push eax
mov byte [ebp - 4], 0x79
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x7b
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x7c
push eax
push esi
call fcn.004093a0
mov byte [ebp - 4], 0x7d
mov byte [ebp - 4], 0x7c
mov ecx, dword [ebp - 0x18]
call fcn.00437830
mov byte [ebp - 4], 0x7b
lea ecx, [ebp - 0x1a8]
call fcn.004087b0
mov byte [ebp - 4], 0x79
lea ecx, [ebp - 0x260]
call fcn.004087b0
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x118]
call fcn.004087b0
mov byte [ebp - 4], 0x6c
lea ecx, [ebp - 0x288]
call fcn.00408bd0
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0xb0]
call fcn.004087b0
mov byte [ebp - 4], 0x6a
lea ecx, [ebp - 0x108]
call fcn.004087b0
mov byte [ebp - 4], 0x69
lea ecx, [ebp - 0x104]
call fcn.004087b0
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0x78]
call fcn.004087b0
mov byte [ebp - 4], 0x67
lea ecx, [ebp - 0xac]
call fcn.004087b0
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x11c]
call fcn.004087b0
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x120]
call fcn.004087b0
push str.Service
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov esi, dword [ebp - 0x18]
test eax, eax
jne 0x432b22
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.00426500
push str.RegSvr32
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x432e02
push eax
push str.File
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0xd0]
call fcn.00405580
mov byte [ebp - 4], 0x7e
push 0
push str.Parameter
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x130]
call fcn.00405580
mov byte [ebp - 4], 0x7f
lea eax, [ebp - 0xd0]
push eax
mov ecx, esi
call fcn.00411850
mov eax, dword [0x476478]
mov dword [ebp - 0xdc], eax
mov byte [ebp - 4], 0x80
mov eax, dword [0x476478]
mov dword [ebp - 0xa8], eax
mov byte [ebp - 4], 0x81
push 0x104
push 0x104
lea ecx, [ebp - 0xdc]
call fcn.00414150
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [ebp - 0xdc]
call fcn.00437810
push str._system32
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x1b0]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x82
push eax
lea ecx, [ebp - 0xa8]
call fcn.00408f00
mov byte [ebp - 4], 0x81
lea ecx, [ebp - 0x1b0]
call fcn.004087b0
lea ecx, [ebp - 0x314]
call fcn.00405150
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push 0x46155c
call fcn.00405580
mov byte [ebp - 4], 0x83
lea eax, [ebp - 0x130]
push eax
push 0x464734
lea eax, [ebp - 0x24c]
push eax
call fcn.00409520
mov byte [ebp - 4], 0x84
push 0x464480
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x85
lea ecx, [ebp - 0xd0]
push ecx
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x86
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push 0x4627a0
push eax
push ecx
call fcn.00409410
mov byte [ebp - 4], 0x87
push ecx
mov eax, esp
mov dword [ebp - 0x54], esp
push str._regsvr32.exe
lea ecx, [ebp - 0xa8]
push ecx
push eax
call fcn.00409410
mov byte [ebp - 4], 0x88
mov byte [ebp - 4], 0x8b
lea ecx, [ebp - 0x314]
call fcn.0040d280
mov byte [ebp - 4], 0x8a
lea ecx, [ebp - 0x224]
call fcn.004087b0
mov byte [ebp - 4], 0x89
lea ecx, [ebp - 0x1b8]
call fcn.004087b0
mov byte [ebp - 4], 0x81
lea ecx, [ebp - 0x24c]
call fcn.004087b0
push str.False
lea ecx, [ebp - 0x1c0]
call fcn.00405580
mov byte [ebp - 4], 0x8c
push eax
push 0
push 0x4644c0
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
call fcn.004090f0
mov byte [ebp + 0xb], al
mov byte [ebp - 4], 0x81
lea ecx, [ebp - 0x1c0]
call fcn.004087b0
cmp byte [ebp + 0xb], 0
je 0x432dc6
push 0x4645e4
lea ecx, [ebp - 0x128]
call fcn.004054c0
mov byte [ebp - 4], 0x8d
push ecx
mov esi, esp
mov dword [ebp + 8], esp
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x128]
push eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.Interaktive_Komponenten_registriert
call fcn.004054c0
mov byte [ebp - 4], 0x8e
lea eax, [ebp - 0x1c8]
push eax
mov byte [ebp - 4], 0x8d
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x8f
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x90
push eax
push esi
call fcn.004093a0
mov byte [ebp - 4], 0x91
mov byte [ebp - 4], 0x90
mov esi, dword [ebp - 0x18]
mov ecx, esi
call fcn.00437830
mov byte [ebp - 4], 0x8f
lea ecx, [ebp - 0x22c]
call fcn.004087b0
mov byte [ebp - 4], 0x8d
lea ecx, [ebp - 0x1c8]
call fcn.004087b0
mov byte [ebp - 4], 0x81
lea ecx, [ebp - 0x128]
call fcn.004087b0
mov byte [ebp - 4], 0x80
lea ecx, [ebp - 0xa8]
call fcn.004087b0
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0xdc]
call fcn.004087b0
mov byte [ebp - 4], 0x7e
lea ecx, [ebp - 0x130]
call fcn.004087b0
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0xd0]
call fcn.004087b0
push str.Rundll32
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x432fbf
push eax
push str.File
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x80]
call fcn.00405580
mov byte [ebp - 4], 0x92
push 0
push str.Parameter
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x140]
call fcn.00405580
mov byte [ebp - 4], 0x93
lea eax, [ebp - 0x80]
push eax
mov ecx, esi
call fcn.00411850
mov eax, dword [0x476478]
mov dword [ebp - 0xe0], eax
mov byte [ebp - 4], 0x94
mov eax, dword [0x476478]
mov dword [ebp - 0xa4], eax
mov byte [ebp - 4], 0x95
push 0x104
push 0x104
lea ecx, [ebp - 0xe0]
call fcn.00414150
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [ebp - 0xe0]
call fcn.00437810
push str._system32
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x264]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x96
push eax
lea ecx, [ebp - 0xa4]
call fcn.00408f00
mov byte [ebp - 4], 0x95
lea ecx, [ebp - 0x264]
call fcn.004087b0
lea ecx, [ebp - 0x314]
call fcn.00405150
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push 0x46155c
call fcn.00405580
mov byte [ebp - 4], 0x97
lea eax, [ebp - 0x80]
push eax
push 0x4627a0
lea eax, [ebp - 0x234]
push eax
call fcn.00409520
mov byte [ebp - 4], 0x98
push 0x464778
push eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x99
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
lea edx, [ebp - 0x140]
push edx
push eax
push ecx
call fcn.004093a0
mov byte [ebp - 4], 0x9a
push ecx
mov eax, esp
mov dword [ebp - 0x54], esp
push str._rundll32.exe
lea ecx, [ebp - 0xa4]
push ecx
push eax
call fcn.00409410
mov byte [ebp - 4], 0x9b
mov byte [ebp - 4], 0x9d
lea ecx, [ebp - 0x314]
call fcn.0040d280
mov byte [ebp - 4], 0x9c
lea ecx, [ebp - 0x1d0]
call fcn.004087b0
mov byte [ebp - 4], 0x95
lea ecx, [ebp - 0x234]
call fcn.004087b0
mov byte [ebp - 4], 0x94
lea ecx, [ebp - 0xa4]
call fcn.004087b0
mov byte [ebp - 4], 0x93
lea ecx, [ebp - 0xe0]
call fcn.004087b0
mov byte [ebp - 4], 0x92
lea ecx, [ebp - 0x140]
call fcn.004087b0
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x80]
call fcn.004087b0
push str.DriverInf
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x43312e
push eax
push str.File
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0xd4]
call fcn.00405580
mov byte [ebp - 4], 0x9e
lea eax, [ebp - 0xd4]
push eax
mov ecx, esi
call fcn.00411850
mov eax, dword [0x476478]
mov dword [ebp - 0xd8], eax
mov byte [ebp - 4], 0x9f
mov eax, dword [0x476478]
mov dword [ebp - 0x84], eax
mov byte [ebp - 4], 0xa0
push 0x104
push 0x104
lea ecx, [ebp - 0xd8]
call fcn.00414150
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [ebp - 0xd8]
call fcn.00437810
push str._system32
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x1d8]
push eax
call fcn.00409410
mov byte [ebp - 4], 0xa1
push eax
lea ecx, [ebp - 0x84]
call fcn.00408f00
mov byte [ebp - 4], 0xa0
lea ecx, [ebp - 0x1d8]
call fcn.004087b0
push 0
call fcn.00438c90
add esp, 4
mov eax, dword [ebp - 0xd4]
cmp dword [eax - 8], 0
jle 0x4330f7
lea ecx, [ebp - 0x314]
call fcn.00405150
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push 0x46155c
call fcn.00405580
mov byte [ebp - 4], 0xa2
push ecx
mov eax, esp
mov dword [ebp - 0x44], esp
lea ecx, [ebp - 0xd4]
push ecx
push str.SETUPAPI.DLL__InstallHinfSection_DefaultInstall_132
push eax
call fcn.00409520
mov byte [ebp - 4], 0xa3
push ecx
mov eax, esp
mov dword [ebp - 0x54], esp
push str._rundll32.exe
lea ecx, [ebp - 0x84]
push ecx
push eax
call fcn.00409410
mov byte [ebp - 4], 0xa4
mov byte [ebp - 4], 0xa0
lea ecx, [ebp - 0x314]
call fcn.0040d280
push 1
call fcn.00438c90
add esp, 4
mov byte [ebp - 4], 0x9f
lea ecx, [ebp - 0x84]
call fcn.004087b0
mov byte [ebp - 4], 0x9e
lea ecx, [ebp - 0xd8]
call fcn.004087b0
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0xd4]
call fcn.004087b0
push str.Execute
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x433344
push eax
push str.Type
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x148]
call fcn.00405580
mov byte [ebp - 4], 0xa5
push 0
push str.File
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x64]
call fcn.00405580
mov byte [ebp - 4], 0xa6
push 0
push str.Parameter
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x98]
call fcn.00405580
mov byte [ebp - 4], 0xa7
lea eax, [ebp - 0x64]
push eax
mov ecx, esi
call fcn.00411850
lea eax, [ebp - 0x98]
push eax
mov ecx, esi
call fcn.00411850
mov eax, dword [ebp - 0x64]
cmp dword [eax - 8], 0
je 0x43331a
push str.shell
push dword [ebp - 0x148]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x433222
push SysReAllocString
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
lea eax, [ebp - 0x98]
push eax
call fcn.00405440
mov byte [ebp - 4], 0xa8
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
lea eax, [ebp - 0x64]
push eax
call fcn.00405440
mov byte [ebp - 4], 0xa9
lea eax, [ebp - 0x254]
push eax
mov byte [ebp - 4], 0xa7
call fcn.004111d0
add esp, 0x10
lea ecx, [ebp - 0x254]
jmp 0x433315
lea ecx, [ebp - 0x314]
call fcn.00405150
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push 0x46155c
call fcn.00405580
mov byte [ebp - 4], 0xaa
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
lea eax, [ebp - 0x98]
push eax
call fcn.00405440
mov byte [ebp - 4], 0xab
push ecx
mov ecx, esp
mov dword [ebp - 0x54], esp
lea eax, [ebp - 0x64]
push eax
call fcn.00405440
mov byte [ebp - 4], 0xac
mov byte [ebp - 4], 0xa7
lea ecx, [ebp - 0x314]
call fcn.0040d280
push str.False
lea ecx, [ebp - 0x1e0]
call fcn.00405580
mov byte [ebp - 4], 0xad
push eax
push 0
push 0x4644c0
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
call fcn.004090f0
mov byte [ebp + 0xb], al
mov byte [ebp - 4], 0xa7
lea ecx, [ebp - 0x1e0]
call fcn.004087b0
cmp byte [ebp + 0xb], 0
je 0x43331a
push ecx
mov esi, esp
mov dword [ebp + 8], esp
lea eax, [ebp - 0x64]
push eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.Prozess_gestartet:
call fcn.004054c0
mov byte [ebp - 4], 0xae
lea eax, [ebp - 0x23c]
push eax
mov byte [ebp - 4], 0xa7
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0xaf
push eax
push esi
call fcn.004093a0
mov byte [ebp - 4], 0xb0
mov byte [ebp - 4], 0xaf
mov esi, dword [ebp - 0x18]
mov ecx, esi
call fcn.00437830
mov byte [ebp - 4], 0xa7
lea ecx, [ebp - 0x23c]
call fcn.004087b0
mov byte [ebp - 4], 0xa6
lea ecx, [ebp - 0x98]
call fcn.004087b0
mov byte [ebp - 4], 0xa5
lea ecx, [ebp - 0x64]
call fcn.004087b0
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x148]
call fcn.004087b0
push str.CopyFile
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x43347a
push eax
push str.From
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x8c]
call fcn.00405580
mov byte [ebp - 4], 0xb1
push 0
push 0x46486c
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x90]
call fcn.00405580
mov byte [ebp - 4], 0xb2
push 0
push str.Overwrite
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x144]
call fcn.00405580
mov byte [ebp - 4], 0xb3
lea eax, [ebp - 0x8c]
push eax
mov ecx, esi
call fcn.00411850
lea eax, [ebp - 0x90]
push eax
mov ecx, esi
call fcn.00411850
lea eax, [ebp - 0x1e8]
push eax
lea ecx, [ebp - 0x90]
call fcn.00426260
mov byte [ebp - 4], 0xb4
mov ecx, eax
call fcn.00425f70
mov byte [ebp - 4], 0xb3
lea ecx, [ebp - 0x1e8]
call fcn.004087b0
mov edi, dword [ebp - 0x8c]
cmp dword [edi - 8], 0
jle 0x43344a
mov esi, dword [ebp - 0x90]
cmp dword [esi - 8], 0
jle 0x43344a
push 0x464888
push dword [ebp - 0x144]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
sete cl
mov eax, dword [esi - 8]
add eax, eax
mov dword [esi - 4], eax
mov eax, dword [edi - 8]
add eax, eax
mov dword [edi - 4], eax
xor eax, eax
test cl, cl
sete al
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov byte [ebp - 4], 0xb2
lea ecx, [ebp - 0x144]
call fcn.004087b0
mov byte [ebp - 4], 0xb1
lea ecx, [ebp - 0x90]
call fcn.004087b0
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x8c]
call fcn.004087b0
mov edi, dword [ebp - 0x30]
push str.Shortcut
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x433d0c
mov word [ebp - 0x8dc], ax
push 0x206
push eax
lea eax, [ebp - 0x8da]
push eax
call fcn.004486f0
add esp, 0xc
mov dword [ebp - 0x20c], 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x8dc]
push eax
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
lea eax, [ebp - 0x8dc]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00405580
mov byte [ebp - 4], 0xb5
push str.AppDataRoamingMicrosoftWindowsStart_MenuPrograms
lea ecx, [ebp - 0x60]
call fcn.00405580
mov byte [ebp - 4], 0xb6
push str.Desktop
lea ecx, [ebp - 0x88]
call fcn.00405580
mov byte [ebp - 4], 0xb7
push 0
push str.File
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x38]
call fcn.00405580
mov byte [ebp - 4], 0xb8
push 0
push str.Name
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x5c]
call fcn.00405580
mov byte [ebp - 4], 0xb9
push 0
push str.Location
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x74]
call fcn.00405580
mov byte [ebp - 4], 0xba
push 0
push str.Start
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
lea ecx, [ebp - 0x94]
call fcn.00405580
mov byte [ebp - 4], 0xbb
lea ecx, [ebp - 0x94]
call fcn.00435810
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x38]
push eax
mov edi, dword [ebp - 0x18]
mov ecx, edi
call fcn.00411850
push str.programs
mov esi, dword [ebp - 0x74]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x43367a
mov eax, dword [ebp - 0x54]
push eax
push eax
push ecx
mov dword [ebp + 8], esp
mov ecx, esp
mov eax, dword [0x476478]
mov dword [ecx], eax
mov byte [ebp - 4], 0xbc
push ecx
mov dword [ebp - 0x44], esp
mov ecx, esp
mov eax, dword [0x476478]
mov dword [ecx], eax
mov byte [ebp - 4], 0xbd
push 0x461514
lea eax, [edi + 0x318]
push eax
lea eax, [ebp - 0x1f8]
push eax
call fcn.00409410
mov byte [ebp - 4], 0xbe
lea ecx, [edi + 0x31c]
push ecx
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0xbf
push 0x461514
push eax
lea eax, [ebp - 0x1f0]
push eax
call fcn.00409410
mov byte [ebp - 4], 0xc0
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
lea edx, [ebp - 0x5c]
push edx
push eax
push ecx
call fcn.004093a0
mov byte [ebp - 4], 0xc1
push 2
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0x38]
push eax
call fcn.00405440
mov byte [ebp - 4], 0xc2
mov byte [ebp - 4], 0xc5
call fcn.0040e0a0
add esp, 0x1c
mov byte [ebp - 4], 0xc4
lea ecx, [ebp - 0x1f0]
call fcn.004087b0
mov byte [ebp - 4], 0xc3
lea ecx, [ebp - 0x210]
call fcn.004087b0
mov byte [ebp - 4], 0xbb
lea ecx, [ebp - 0x1f8]
call fcn.004087b0
push str.desktop
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4336e2
push eax
push eax
push ecx
mov dword [ebp + 8], esp
mov ecx, esp
mov eax, dword [0x476478]
mov dword [ecx], eax
mov byte [ebp - 4], 0xc6
push ecx
mov dword [ebp - 0x20], esp
mov ecx, esp
mov eax, dword [0x476478]
mov dword [ecx], eax
mov byte [ebp - 4], 0xc7
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
lea eax, [ebp - 0x5c]
push eax
call fcn.00405440
mov byte [ebp - 4], 0xc8
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
lea eax, [ebp - 0x38]
push eax
call fcn.00405440
mov byte [ebp - 4], 0xc9
mov byte [ebp - 4], 0xbb
call fcn.0040e0a0
add esp, 0x1c
lea ecx, [ebp - 0x10ca0]
call fcn.004036d0
mov byte [ebp - 4], 0xca
push 0x462750
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00409410
mov byte [ebp - 4], 0xcb
mov edx, dword [eax]
mov ecx, dword [edx - 8]
add ecx, ecx
mov dword [edx - 4], ecx
push 0
push dword [eax]
lea ecx, [ebp - 0x10ca0]
call fcn.00412990
mov edi, eax
mov byte [ebp - 4], 0xca
lea ecx, [ebp - 0x218]
call fcn.004087b0
test edi, edi
je 0x433bb3
lea eax, [ebp - 0x200]
push eax
lea ecx, [ebp - 0x10ca0]
call fcn.00414f50
mov byte [ebp - 4], 0xcc
push 0
push dword [eax]
push str.Public
call fcn.00410290
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], 0xca
lea ecx, [ebp - 0x200]
call fcn.004087b0
test edi, edi
jne 0x433ba1
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x10ca0]
call fcn.00414f50
mov byte [ebp - 4], 0xcd
push edi
push dword [eax]
push str.All_Users
call fcn.00410290
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], 0xca
lea ecx, [ebp - 0x220]
call fcn.004087b0
test edi, edi
jne 0x433ba1
push str.desktop
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x433825
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x10ca0]
call fcn.00414f50
mov byte [ebp - 4], 0xce
mov edi, dword [ebp - 0x48]
or edi, 1
mov dword [ebp - 0x48], edi
lea ecx, [ebp - 0x88]
push ecx
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.004093a0
mov dword [ebp - 4], 0xcf
or edi, 2
mov dword [ebp - 0x48], edi
mov edx, dword [eax]
mov ecx, dword [edx - 8]
add ecx, ecx
mov dword [edx - 4], ecx
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov byte [ebp + 0xb], 1
jne 0x433829
mov byte [ebp + 0xb], 0
mov dword [ebp - 4], 0xce
mov eax, dword [ebp - 0x48]
test al, 2
je 0x43384b
and eax, 0xfffffffd
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x208]
call fcn.004087b0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 4], 0xca
test al, 1
je 0x433867
and eax, 0xfffffffe
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x228]
call fcn.004087b0
cmp byte [ebp + 0xb], 0
je 0x433963
push 0
push 0
push ecx
mov dword [ebp + 8], esp
mov ecx, esp
mov eax, dword [0x476478]
mov dword [ecx], eax
mov byte [ebp - 4], 0xd0
push ecx
mov dword [ebp - 0x20], esp
mov ecx, esp
mov eax, dword [0x476478]
mov dword [ecx], eax
mov byte [ebp - 4], 0xd1
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x10ca0]
call fcn.00414f50
mov byte [ebp - 4], 0xd2
lea ecx, [ebp - 0x88]
push ecx
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0xd3
push 0x461514
push eax
lea eax, [ebp - 0x190]
push eax
call fcn.00409410
mov byte [ebp - 4], 0xd4
lea ecx, [ebp - 0x5c]
push ecx
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0xd5
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
push str..lnk
push eax
push ecx
call fcn.00409410
mov byte [ebp - 4], 0xd6
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
lea eax, [ebp - 0x38]
push eax
call fcn.00405440
mov byte [ebp - 4], 0xd7
mov byte [ebp - 4], 0xdb
call fcn.0040e0a0
add esp, 0x1c
mov byte [ebp - 4], 0xda
lea ecx, [ebp - 0x230]
call fcn.004087b0
mov byte [ebp - 4], 0xd9
lea ecx, [ebp - 0x190]
call fcn.004087b0
mov byte [ebp - 4], 0xd8
lea ecx, [ebp - 0x194]
call fcn.004087b0
mov byte [ebp - 4], 0xca
lea ecx, [ebp - 0x19c]
call fcn.004087b0
push str.programs
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4339ca
lea eax, [ebp - 0x1ac]
push eax
lea ecx, [ebp - 0x10ca0]
call fcn.00414f50
mov byte [ebp - 4], 0xdc
mov edi, dword [ebp - 0x48]
or edi, 4
mov dword [ebp - 0x48], edi
lea ecx, [ebp - 0x60]
push ecx
push eax
lea eax, [ebp - 0x1a4]
push eax
call fcn.004093a0
mov dword [ebp - 4], 0xdd
or edi, 8
mov dword [ebp - 0x48], edi
mov edx, dword [eax]
mov ecx, dword [edx - 8]
add ecx, ecx
mov dword [edx - 4], ecx
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
mov byte [ebp + 0xb], 1
jne 0x4339ce
mov byte [ebp + 0xb], 0
mov dword [ebp - 4], 0xdc
mov eax, dword [ebp - 0x48]
test al, 8
je 0x4339f0
and eax, 0xfffffff7
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x1a4]
call fcn.004087b0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 4], 0xca
test al, 4
je 0x433a0c
and eax, 0xfffffffb
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x1ac]
call fcn.004087b0
cmp byte [ebp + 0xb], 0
je 0x433ba1
mov eax, dword [ebp - 0x54]
push eax
push eax
push ecx
mov dword [ebp + 8], esp
mov ecx, esp
mov eax, dword [0x476478]
mov dword [ecx], eax
mov byte [ebp - 4], 0xde
push ecx
mov dword [ebp - 0x20], esp
mov ecx, esp
mov eax, dword [0x476478]
mov dword [ecx], eax
mov byte [ebp - 4], 0xdf
lea eax, [ebp - 0x1ec]
push eax
lea ecx, [ebp - 0x10ca0]
call fcn.00414f50
mov byte [ebp - 4], 0xe0
lea ecx, [ebp - 0x60]
push ecx
push eax
lea eax, [ebp - 0x1e4]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0xe1
push 0x461514
push eax
lea eax, [ebp - 0x1dc]
push eax
call fcn.00409410
mov byte [ebp - 4], 0xe2
mov edi, dword [ebp - 0x18]
lea ecx, [edi + 0x318]
push ecx
push eax
lea eax, [ebp - 0x1d4]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0xe3
push 0x461514
push eax
lea eax, [ebp - 0x1cc]
push eax
call fcn.00409410
mov byte [ebp - 4], 0xe4
lea ecx, [edi + 0x31c]
push ecx
push eax
lea eax, [ebp - 0x1c4]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0xe5
push 0x461514
push eax
lea eax, [ebp - 0x1bc]
push eax
call fcn.00409410
mov byte [ebp - 4], 0xe6
lea ecx, [ebp - 0x5c]
push ecx
push eax
lea eax, [ebp - 0x1b4]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0xe7
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
push str..lnk
push eax
push ecx
call fcn.00409410
mov byte [ebp - 4], 0xe8
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
lea eax, [ebp - 0x38]
push eax
call fcn.00405440
mov byte [ebp - 4], 0xe9
mov byte [ebp - 4], 0xf1
call fcn.0040e0a0
add esp, 0x1c
mov byte [ebp - 4], 0xf0
lea ecx, [ebp - 0x1b4]
call fcn.004087b0
mov byte [ebp - 4], 0xef
lea ecx, [ebp - 0x1bc]
call fcn.004087b0
mov byte [ebp - 4], 0xee
lea ecx, [ebp - 0x1c4]
call fcn.004087b0
mov byte [ebp - 4], 0xed
lea ecx, [ebp - 0x1cc]
call fcn.004087b0
mov byte [ebp - 4], 0xec
lea ecx, [ebp - 0x1d4]
call fcn.004087b0
mov byte [ebp - 4], 0xeb
lea ecx, [ebp - 0x1dc]
call fcn.004087b0
mov byte [ebp - 4], 0xea
lea ecx, [ebp - 0x1e4]
call fcn.004087b0
mov byte [ebp - 4], 0xca
lea ecx, [ebp - 0x1ec]
call fcn.004087b0
lea ecx, [ebp - 0x10ca0]
call fcn.00413000
mov edi, eax
jmp 0x433734
push str.False
lea ecx, [ebp - 0x134]
call fcn.00405580
mov byte [ebp - 4], 0xf2
push eax
push 0
push 0x4644c0
lea ecx, [ebp - 0x14]
call fcn.0043edc0
push eax
call fcn.004090f0
mov byte [ebp + 0xb], al
mov byte [ebp - 4], 0xca
lea ecx, [ebp - 0x134]
call fcn.004087b0
cmp byte [ebp + 0xb], 0
je 0x433c9e
push str.:__r_n
lea ecx, [ebp - 0x138]
call fcn.004054c0
mov byte [ebp - 4], 0xf3
push ecx
mov esi, esp
mov dword [ebp + 8], esp
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x138]
push eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x464990
call fcn.004054c0
mov byte [ebp - 4], 0xf4
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0xf3
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0xf5
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0xf6
push eax
push esi
call fcn.004093a0
mov byte [ebp - 4], 0xf7
mov byte [ebp - 4], 0xf6
mov edi, dword [ebp - 0x18]
mov ecx, edi
call fcn.00437830
mov byte [ebp - 4], 0xf5
lea ecx, [ebp - 0xa0]
call fcn.004087b0
mov byte [ebp - 4], 0xf3
lea ecx, [ebp - 0x1c]
call fcn.004087b0
mov byte [ebp - 4], 0xca
lea ecx, [ebp - 0x138]
call fcn.004087b0
jmp 0x433ca1
mov edi, dword [ebp - 0x18]
mov byte [ebp - 4], 0xbb
lea ecx, [ebp - 0x10ca0]
call fcn.00406af0
mov byte [ebp - 4], 0xba
lea ecx, [ebp - 0x94]
call fcn.004087b0
mov byte [ebp - 4], 0xb9
lea ecx, [ebp - 0x74]
call fcn.004087b0
mov byte [ebp - 4], 0xb8
lea ecx, [ebp - 0x5c]
call fcn.004087b0
mov byte [ebp - 4], 0xb7
lea ecx, [ebp - 0x38]
call fcn.004087b0
mov byte [ebp - 4], 0xb6
lea ecx, [ebp - 0x88]
call fcn.004087b0
mov byte [ebp - 4], 0xb5
lea ecx, [ebp - 0x60]
call fcn.004087b0
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x2c]
call fcn.004087b0
jmp 0x433d0f
mov edi, dword [ebp - 0x18]
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x40]
call fcn.004087b0
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x30]
call fcn.004087b0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x28]
call fcn.004087b0
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x24]
call fcn.004087b0
mov byte [ebp - 4], 0x31
push dword [ebp - 0x14]
call fcn.0043d220
add esp, 4
mov dword [ebp - 4], 0x1f
or esi, 0xffffffff
mov eax, dword [ebp - 0x50]
inc eax
jmp 0x431847
cmp dword [edi + 0x158], 0
je 0x433dbd
mov eax, dword [edi + 0x180]
cmp eax, 0xffffffff
je 0x433dbd
push 0
push 0
push eax
call sub.RstrtMgr.DLL_RmRestart
test eax, eax
jne 0x433dbd
push dword [edi + 0x180]
call sub.RstrtMgr.DLL_RmEndSession
mov dword [edi + 0x180], 0xffffffff
xor eax, eax
mov word [edi + 0x184], ax
mov eax, dword [0x476478]
mov dword [ebp - 0x15c], eax
mov byte [ebp - 4], 0xf9
mov dword [ebp - 0x164], SysReAllocString
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x158], 0x100
mov dword [ebp - 0x150], 0
mov byte [ebp - 4], 0xfa
mov dword [ebp - 0x164], reloc.OLEAUT32.dll_SysReAllocString
push 0xf003f
push 1
lea esi, [edi + 0x31c]
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push eax
call fcn.00409520
mov byte [ebp - 4], 0xfb
mov byte [ebp - 4], 0xfa
lea ecx, [ebp - 0x168]
call fcn.0042b170
push 0x461928
push esi
lea eax, [ebp + 8]
push eax
call fcn.00409410
mov byte [ebp - 4], 0xfc
lea edx, [edi + 0x1fc]
mov dword [ebp - 0xa0], edx
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push edx
push eax
push ecx
call fcn.004093a0
mov byte [ebp - 4], 0xfd
push ecx
mov dword [ebp - 0x3c], esp
mov ecx, esp
mov dword [ebp - 0x1c], ecx
mov eax, dword [0x476478]
mov dword [ecx], eax
mov edx, str.DisplayName
mov eax, edx
shr eax, 0x10
test eax, eax
jne 0x433e98
movzx eax, dx
push eax
call fcn.0041c880
jmp 0x433ef6
push str.DisplayName
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x433ef6
lea ecx, [esi*2 + 0x22]
push ecx
call fcn.004451f4
add esp, 4
test eax, eax
je 0x433ef6
mov dword [eax], 1
xor ecx, ecx
mov word [eax + esi*2 + 0x20], cx
mov dword [eax + 0x18], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0x10], ecx
lea ecx, [eax + 0x20]
mov eax, dword [ebp - 0x1c]
mov dword [eax], ecx
lea eax, [esi + esi]
push eax
push str.DisplayName
push ecx
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 0xfe
mov byte [ebp - 4], 0xfc
lea ecx, [ebp - 0x168]
call fcn.00439580
mov byte [ebp - 4], 0xfa
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x433f39
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x433f39
mov eax, dword [ebp + 8]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
add edi, 0x254
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
push 0x4649c0
push edi
push eax
call fcn.00409410
mov byte [ebp - 4], 0xff
push ecx
mov dword [ebp - 0x3c], esp
mov ecx, esp
mov dword [ebp + 8], ecx
mov eax, dword [0x476478]
mov dword [ecx], eax
mov edx, str.DisplayIcon
mov eax, edx
shr eax, 0x10
test eax, eax
jne 0x433f7e
movzx eax, dx
push eax
call fcn.0041c880
jmp 0x433fdc
push str.DisplayIcon
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x433fdc
lea ecx, [esi*2 + 0x22]
push ecx
call fcn.004451f4
add esp, 4
test eax, eax
je 0x433fdc
mov dword [eax], 1
xor ecx, ecx
mov word [eax + esi*2 + 0x20], cx
mov dword [eax + 0x18], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0x10], ecx
lea ecx, [eax + 0x20]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
lea eax, [esi + esi]
push eax
push str.DisplayIcon
push ecx
call fcn.004480a0
add esp, 0xc
mov dword [ebp - 4], 0x100
mov dword [ebp - 4], 0xfa
lea ecx, [ebp - 0x168]
call fcn.00439580
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
push 0x4649c0
push edi
push eax
call fcn.00409410
mov dword [ebp - 4], 0x101
push ecx
mov dword [ebp - 0x3c], esp
mov ecx, esp
mov dword [ebp + 8], ecx
mov eax, dword [0x476478]
mov dword [ecx], eax
mov edx, str.UninstallPath
mov eax, edx
shr eax, 0x10
test eax, eax
jne 0x434037
movzx eax, dx
push eax
call fcn.0041c880
jmp 0x434095
push str.UninstallPath
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x434095
lea ecx, [esi*2 + 0x22]
push ecx
call fcn.004451f4
add esp, 4
test eax, eax
je 0x434095
mov dword [eax], 1
xor ecx, ecx
mov word [eax + esi*2 + 0x20], cx
mov dword [eax + 0x18], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0x10], ecx
lea ecx, [eax + 0x20]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
lea eax, [esi + esi]
push eax
push str.UninstallPath
push ecx
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 2
mov dword [ebp - 4], 0xfa
lea ecx, [ebp - 0x168]
call fcn.00439580
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push 0x4649c0
push edi
push eax
call fcn.00409410
mov dword [ebp - 4], 0x103
push ecx
mov dword [ebp - 0x20], esp
mov edi, esp
mov eax, dword [0x476478]
mov dword [edi], eax
mov ecx, str.UninstallString
mov eax, ecx
shr eax, 0x10
test eax, eax
jne 0x4340ec
movzx eax, cx
push eax
mov ecx, edi
call fcn.0041c880
jmp 0x434147
push str.UninstallString
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x434147
lea ecx, [esi*2 + 0x22]
push ecx
call fcn.004451f4
add esp, 4
test eax, eax
je 0x434147
mov dword [eax], 1
xor ecx, ecx
mov word [eax + esi*2 + 0x20], cx
mov dword [eax + 0x18], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0x10], ecx
lea ecx, [eax + 0x20]
mov dword [edi], ecx
lea eax, [esi + esi]
push eax
push str.UninstallString
push ecx
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 4
mov dword [ebp - 4], 0xfa
lea ecx, [ebp - 0x168]
call fcn.00439580
mov eax, dword [ebp - 0x114]
mov edi, dword [ebp - 0x110]
shrd eax, edi, 0xa
mov dword [ebp - 0x2c], eax
shr edi, 0xa
mov esi, dword [0x476478]
mov dword [ebp - 0x50], esi
mov dword [ebp - 4], 0x105
xor eax, eax
mov word [ebp - 0x394], ax
push 0x7e
push eax
lea eax, [ebp - 0x392]
push eax
call fcn.004486f0
push edi
push dword [ebp - 0x2c]
push str._I64d
lea eax, [ebp - 0x394]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea eax, [ebp - 0x394]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
mov dword [ebp - 0x1c], edi
mov eax, 1
lea ecx, [esi - 0x20]
mov dword [ebp + 8], ecx
cmp dword [ecx], eax
jg 0x4341de
cmp edi, dword [esi - 0xc]
jle 0x43426f
lea eax, [esi - 0x20]
cmp eax, dword [0x476474]
je 0x434224
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x434218
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x43420f
push eax
call fcn.00446dea
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
push ecx
call fcn.004471aa
add esp, 4
mov eax, dword [0x476478]
mov esi, eax
mov dword [ebp - 0x50], esi
jmp 0x434229
mov eax, dword [0x476478]
test edi, edi
jne 0x434231
mov esi, eax
jmp 0x434267
lea eax, [edi*2 + 0x22]
push eax
call fcn.004451f4
add esp, 4
test eax, eax
je 0x43426f
mov dword [eax], 1
xor ecx, ecx
mov word [eax + edi*2 + 0x20], cx
mov dword [eax + 0x18], edi
mov dword [eax + 0x14], edi
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0x10], ecx
lea esi, [eax + 0x20]
mov dword [ebp - 0x50], esi
mov eax, 1
mov dword [esi - 0x14], 0
test eax, eax
je 0x43429d
add edi, edi
push edi
lea eax, [ebp - 0x394]
push eax
lea eax, [edi + 2]
push eax
push esi
call fcn.00445948
add esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [esi - 8], eax
xor eax, eax
mov word [esi + edi], ax
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0x50]
push eax
call fcn.00405440
mov byte [ebp - 4], 6
push ecx
mov dword [ebp - 0x3c], esp
mov edi, esp
mov eax, dword [0x476478]
mov dword [edi], eax
mov ecx, 0x463b8c
mov eax, ecx
shr eax, 0x10
test eax, eax
jne 0x4342d8
movzx eax, cx
push eax
mov ecx, edi
call fcn.0041c880
jmp 0x43430b
push 0x463b8c
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp + 8], eax
test eax, eax
je 0x43430b
push eax
mov ecx, edi
call fcn.0040a900
test eax, eax
je 0x43430b
mov eax, dword [ebp + 8]
add eax, eax
push eax
push 0x463b8c
push dword [edi]
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 7
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x168]
call fcn.00439580
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push dword [ebp - 0xa0]
call fcn.00405440
mov byte [ebp - 4], 8
push ecx
mov dword [ebp - 0x3c], esp
mov edi, esp
mov eax, dword [0x476478]
mov dword [edi], eax
mov ecx, str.DisplayVersion
mov eax, ecx
shr eax, 0x10
test eax, eax
jne 0x43435b
movzx eax, cx
push eax
mov ecx, edi
call fcn.0041c880
jmp 0x43438e
push str.DisplayVersion
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp + 8], eax
test eax, eax
je 0x43438e
push eax
mov ecx, edi
call fcn.0040a900
test eax, eax
je 0x43438e
mov eax, dword [ebp + 8]
add eax, eax
push eax
push str.DisplayVersion
push dword [edi]
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 9
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x168]
call fcn.00439580
mov edi, dword [ebp - 0x18]
lea eax, [edi + 0x318]
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.00405440
mov byte [ebp - 4], 0xa
push ecx
mov dword [ebp - 0x3c], esp
mov ecx, esp
mov dword [ebp + 8], ecx
mov eax, dword [0x476478]
mov dword [ecx], eax
mov edx, str.Publisher
mov eax, edx
shr eax, 0x10
test eax, eax
jne 0x4343e3
movzx eax, dx
push eax
call fcn.0041c880
jmp 0x43441a
push str.Publisher
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x43441a
push eax
mov ecx, dword [ebp + 8]
call fcn.0040a900
test eax, eax
je 0x43441a
mov eax, dword [ebp - 0x1c]
add eax, eax
push eax
push str.Publisher
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 0xb
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x168]
call fcn.00439580
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
lea edx, [edi + 0x254]
push edx
call fcn.00405440
mov byte [ebp - 4], 0xc
push ecx
mov dword [ebp - 0x3c], esp
mov ecx, esp
mov dword [ebp + 8], ecx
mov eax, dword [0x476478]
mov dword [ecx], eax
mov edx, str.InstallLocation
mov eax, edx
shr eax, 0x10
test eax, eax
jne 0x43446c
movzx eax, dx
push eax
call fcn.0041c880
jmp 0x4344a3
push str.InstallLocation
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4344a3
push eax
mov ecx, dword [ebp + 8]
call fcn.0040a900
test eax, eax
je 0x4344a3
mov eax, dword [ebp - 0x1c]
add eax, eax
push eax
push str.InstallLocation
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x168]
call fcn.00439580
push ecx
mov eax, esp
mov dword [ebp - 0x20], esp
push 0
push eax
call fcn.00416490
mov byte [ebp - 4], 0xe
add esp, 4
mov dword [ebp - 0x3c], esp
mov ecx, esp
mov dword [ebp + 8], ecx
mov eax, dword [0x476478]
mov dword [ecx], eax
mov edx, str.InstallSource
mov eax, edx
shr eax, 0x10
test eax, eax
jne 0x4344f3
movzx eax, dx
push eax
call fcn.0041c880
jmp 0x43452a
push str.InstallSource
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x43452a
push eax
mov ecx, dword [ebp + 8]
call fcn.0040a900
test eax, eax
je 0x43452a
mov eax, dword [ebp - 0x1c]
add eax, eax
push eax
push str.InstallSource
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 0xf
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x168]
call fcn.00439580
lea edx, [edi + 0x330]
lea eax, [edi + 0x1f4]
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
push edx
push ecx
call fcn.004093a0
mov byte [ebp - 4], 0x10
push ecx
mov dword [ebp - 0x3c], esp
mov ecx, esp
mov dword [ebp + 8], ecx
mov eax, dword [0x476478]
mov dword [ecx], eax
mov edx, str.URLInfoAbout
mov eax, edx
shr eax, 0x10
test eax, eax
jne 0x434584
movzx eax, dx
push eax
call fcn.0041c880
jmp 0x4345bb
push str.URLInfoAbout
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4345bb
push eax
mov ecx, dword [ebp + 8]
call fcn.0040a900
test eax, eax
je 0x4345bb
mov eax, dword [ebp - 0x1c]
add eax, eax
push eax
push str.URLInfoAbout
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x168]
call fcn.00439580
lea eax, [edi + 0x1f8]
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
lea eax, [edi + 0x330]
push eax
push ecx
call fcn.004093a0
mov byte [ebp - 4], 0x12
push ecx
mov dword [ebp - 0x3c], esp
mov ecx, esp
mov dword [ebp + 8], ecx
mov eax, dword [0x476478]
mov dword [ecx], eax
mov edx, str.URLUpdateInfo
mov eax, edx
shr eax, 0x10
test eax, eax
jne 0x434615
movzx eax, dx
push eax
call fcn.0041c880
jmp 0x43464c
push str.URLUpdateInfo
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x43464c
push eax
mov ecx, dword [ebp + 8]
call fcn.0040a900
test eax, eax
je 0x43464c
mov eax, dword [ebp - 0x1c]
add eax, eax
push eax
push str.URLUpdateInfo
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 0x13
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x168]
call fcn.00439580
push dword [ebp - 0x2c]
push ecx
mov dword [ebp - 0x20], esp
mov ecx, esp
mov dword [ebp + 8], ecx
mov eax, dword [0x476478]
mov dword [ecx], eax
mov edx, str.EstimatedSize
mov eax, edx
shr eax, 0x10
test eax, eax
jne 0x43468b
movzx eax, dx
push eax
call fcn.0041c880
jmp 0x4346c2
push str.EstimatedSize
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4346c2
push eax
mov ecx, dword [ebp + 8]
call fcn.0040a900
test eax, eax
je 0x4346c2
mov eax, dword [ebp - 0x1c]
add eax, eax
push eax
push str.EstimatedSize
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.004480a0
add esp, 0xc
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x168]
call fcn.004390e0
cmp dword [edi + 0x250], 0
jne 0x434759
push ecx
mov edi, esp
mov dword [ebp + 8], esp
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Systemwiederherstellungspunkt_wird_geschlossen.
call fcn.004054c0
mov byte [ebp - 4], 0x15
push edi
mov byte [ebp - 4], 5
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x16
mov byte [ebp - 4], 5
mov edi, dword [ebp - 0x18]
mov ecx, edi
call fcn.00437830
mov ecx, dword [ebp - 0x39c]
test ecx, ecx
je 0x434759
mov dword [ebp - 0x5b8], 0x65
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x5b0], eax
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x5ac], eax
lea eax, [ebp - 0x3a8]
push eax
lea eax, [ebp - 0x5b8]
push eax
call ecx
mov ecx, dword [edi + 0x254]
mov eax, dword [ecx - 8]
add eax, eax
mov dword [ecx - 4], eax
push dword [edi + 0x254]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x434a0f
push 0x4649c0
lea eax, [edi + 0x254]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00409410
mov byte [ebp - 4], 0x17
cmp dword [edi + 0x334], 0
je 0x4347dc
push 0
push 1
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
lea eax, [ebp - 0x38]
push eax
call fcn.00405440
mov byte [ebp - 4], 0x18
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x464aec
call fcn.00405580
mov byte [ebp - 4], 0x19
mov byte [ebp - 4], 0x17
mov ecx, dword [edi + 0x334]
call fcn.00411fe0
jmp 0x4349df
push str.uninstall.exe
lea ecx, [ebp - 0x94]
call fcn.004054c0
mov byte [ebp - 4], 0x1a
push 0
lea eax, [ebp - 0x74]
push eax
call fcn.00416490
add esp, 8
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x94]
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx - 8]
add edx, edx
mov dword [ecx - 4], edx
mov edi, dword [ebp - 0x38]
mov edx, dword [eax]
mov ecx, dword [edx - 8]
add ecx, ecx
mov dword [edx - 4], ecx
push 0
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
sete byte [ebp + 0xb]
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x2c]
lea ecx, [eax - 0x20]
or edi, 0xffffffff
cmp ecx, dword [0x476474]
je 0x434872
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x434872
mov eax, dword [ebp - 0x2c]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x1a
mov eax, dword [ebp - 0x74]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x4348a1
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4348a1
mov eax, dword [ebp - 0x74]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0x94]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x4348cd
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4348cd
push ecx
call fcn.004471aa
add esp, 4
cmp byte [ebp + 0xb], 0
je 0x4349dc
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], 0
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x100], 0x461694
mov dword [ebp - 0xf8], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0xf0], xmm0
movlpd qword [ebp - 0xe8], xmm0
mov byte [ebp - 4], 0x1e
push 2
push 0x96
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0xc0]
call fcn.0041ab30
test eax, eax
je 0x434969
push 1
lea eax, [ebp - 0x100]
push eax
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
lea eax, [ebp - 0x38]
push eax
call fcn.00405440
mov byte [ebp - 4], 0x1f
mov byte [ebp - 4], 0x1e
call fcn.00429100
add esp, 0xc
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x100], 0x461694
mov eax, dword [ebp - 0xf8]
test eax, eax
je 0x434996
cmp eax, 0xffffffff
je 0x434996
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xf8], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0xf0], xmm0
movlpd qword [ebp - 0xe8], xmm0
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0xc0]
test eax, eax
je 0x4349dc
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
mov edi, dword [ebp - 0x18]
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x38]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x434a0f
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x434a0f
mov eax, dword [ebp - 0x38]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
lea eax, [ebp - 0x2bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [0x476478]
mov dword [ebp + 8], eax
mov byte [ebp - 4], 0x20
movzx eax, word [ebp - 0x2bc]
push eax
movzx eax, word [ebp - 0x2ba]
push eax
movzx eax, word [ebp - 0x2b6]
push eax
push str._u._u._u
lea eax, [ebp + 8]
push eax
call fcn.004134b0
add esp, 0x10
mov ecx, esp
mov dword [ebp - 0x20], esp
lea eax, [ebp + 8]
push eax
call fcn.00405440
mov byte [ebp - 4], 0x21
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
push str.InstallDate
call fcn.00405580
mov byte [ebp - 4], 0x22
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x168]
call fcn.00439580
lea edx, [edi + 0x338]
mov eax, dword [edx]
cmp dword [eax - 8], 0
je 0x434ace
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push edx
call fcn.00405440
mov byte [ebp - 4], 0x23
push ecx
mov eax, esp
mov dword [ebp - 0x3c], esp
push str._vextend.dat
lea edx, [edi + 0x254]
push edx
push eax
call fcn.00409410
mov byte [ebp - 4], 0x24
mov byte [ebp - 4], 0x20
call fcn.004292c0
add esp, 0xc
push str.continue
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x476494
call fcn.0043e6c0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [0x47649c]
je 0x434af8
mov eax, dword [0x47fe00]
mov dword [eax + 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x46155c
call fcn.00405580
mov byte [ebp - 4], 0x25
mov byte [ebp - 4], 0x20
mov ecx, edi
call fcn.00437830
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x4642c0
call fcn.00405580
mov byte [ebp - 4], 0x26
mov byte [ebp - 4], 0x20
mov ecx, edi
call fcn.00437830
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x46155c
call fcn.00405580
mov byte [ebp - 4], 0x27
mov byte [ebp - 4], 0x20
mov ecx, edi
call fcn.00437830
push ecx
mov dword [ebp - 0x20], esp
cmp dword [edi + 0x310], 0
mov edi, esp
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
je 0x434cb9
push str.Installation_unvollst
call fcn.004054c0
mov byte [ebp - 4], 0x28
push edi
mov byte [ebp - 4], 0x20
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x29
mov byte [ebp - 4], 0x20
mov edi, dword [ebp - 0x18]
mov ecx, edi
call fcn.00437830
push dword [edi + 0x310]
push 0x4618e0
lea eax, [ebp + 8]
push eax
call fcn.004134b0
add esp, 0xc
push 0x461560
lea ecx, [ebp - 0x94]
call fcn.004054c0
mov byte [ebp - 4], 0x2a
push ecx
mov edi, esp
mov dword [ebp - 0x20], esp
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x94]
push eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x3c], esp
push str.Es_traten_Fehler_auf
call fcn.004054c0
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x74]
push eax
mov byte [ebp - 4], 0x2a
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x2c
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004093a0
mov byte [ebp - 4], 0x2d
push eax
push edi
call fcn.004093a0
mov byte [ebp - 4], 0x2e
mov byte [ebp - 4], 0x2d
mov edi, dword [ebp - 0x18]
mov ecx, edi
call fcn.00437830
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x2c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x434c5a
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x434c5a
mov eax, dword [ebp - 0x2c]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x2a
mov eax, dword [ebp - 0x74]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x434c8a
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x434c8a
mov eax, dword [ebp - 0x74]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x94]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x434ce6
lea ecx, [eax - 0x20]
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x434ce6
push ecx
call fcn.004471aa
add esp, 4
jmp 0x434ce6
push str.Installation_erfolgreich.
call fcn.004054c0
mov byte [ebp - 4], 0x2f
push edi
mov byte [ebp - 4], 0x20
call fcn.00417060
add esp, 0xc
mov byte [ebp - 4], 0x30
mov byte [ebp - 4], 0x20
mov edi, dword [ebp - 0x18]
mov ecx, edi
call fcn.00437830
cmp dword [edi + 0x310], 0
je 0x434cf6
mov ecx, edi
call fcn.0042a3a0
push dword [edi + 0x298]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x434d27
push dword [edi + 0x298]
call dword [sym.imp.USER32.dll_IsWindow]
push 0
push 0x64
push 0x402
push dword [edi + 0x298]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0x278], 1
mov byte [ebp - 4], 5
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x20]
or edi, 0xffffffff
cmp ecx, dword [0x476474]
je 0x434d5d
lea ecx, [eax - 0x20]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x434d5d
push ecx
call fcn.004471aa
add esp, 4
mov dword [ebp - 4], 0xfa
lea eax, [esi - 0x20]
cmp eax, dword [0x476474]
je 0x434d86
add esi, 0xffffffe0
mov eax, edi
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x434d86
push esi
call fcn.004471aa
add esp, 4
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x168]
call fcn.00408bd0
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x9c]
lea ecx, [eax - 0x20]
cmp ecx, dword [0x476474]
je 0x434dc8
add eax, 0xffffffe0
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x434dc8
mov eax, dword [ebp - 0x9c]
add eax, 0xffffffe0
push eax
call fcn.004471aa
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x398]
test eax, eax
je 0x434dea
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 0x398], 0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4