Function at 0x407460
Capabilities:
Contain obfuscated stackstrings
Delete registry key
Print debug messages
Shutdown system

Disassembly:
push 0xffffffffffffffff
push 0x432345
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x140
mov eax, dword [0x442184]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14c], eax
mov esi, ecx
call fcn.00425d0d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x34], eax
mov ebp, dword [esp + 0x160]
push ebp
push str.enter_operation_type
lea eax, [esp + 0x3c]
push str._s_ld
push eax
mov dword [esp + 0x168], 0
call fcn.00401ad0
mov ecx, dword [esp + 0x44]
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add esp, 0x10
push ecx
call edi
push str.HKAPP
push str.HKAPP
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x4074fa
push 0
push 0
push 2
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x407501
push str.hWnd___desktoy___error
call edi
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push str.HKAPP.exe
mov ecx, esi
mov dword [esp + 0x3c], eax
xor edi, edi
call fcn.00404ec0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call ebx
cmp ebp, 1
jne 0x407b65
push ebp
mov ecx, esi
mov dword [esi + 0x84], ebp
call fcn.00405cd0
push ebp
mov ecx, esi
call fcn.00406860
test eax, eax
je 0x4078cd
push ebp
mov ecx, esi
call fcn.00404280
push edi
mov ecx, esi
call fcn.00404280
push ebp
mov ecx, esi
call fcn.00403380
push ebp
mov ecx, esi
call fcn.00402cd0
mov eax, dword [esi + 0x74]
test eax, eax
jne 0x408322
mov eax, dword [esi + 0x144]
test eax, eax
jne 0x4078c6
call fcn.00425d0d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x158], 1
call fcn.00425d0d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x2c], eax
mov byte [esp + 0x158], 2
call fcn.00425d0d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x158], 3
call fcn.00425d0d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x24], eax
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
mov bl, 4
push 0x4355a0
mov byte [esp + 0x160], bl
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Msg_SetupSuccess
mov byte [esp + 0x164], 5
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.ClientSetup
mov byte [esp + 0x168], 6
call fcn.004053e0
mov ecx, dword [esi + 0x14c]
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x168], bl
call fcn.0040b530
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x15c], 7
call fcn.00401a20
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x158], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407692
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0x160]
mov ecx, dword [esp + 0x24]
push eax
push ecx
lea edx, [esp + 0x1c]
push str._s_s
push edx
call fcn.00401ad0
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x435230
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Msg_AskRestart
mov byte [esp + 0x164], 8
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push str.ClientSetup
mov byte [esp + 0x168], 9
call fcn.004053e0
mov ecx, dword [esi + 0x14c]
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x168], bl
call fcn.0040b530
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x15c], 0xa
call fcn.00401a20
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x158], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407740
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str._r_n_r_n
lea ecx, [esp + 0x18]
call fcn.004053a0
mov ecx, dword [esp + 0x2c]
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [esp + 0x1c]
call fcn.004047d0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x43520c
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Msg_DesSetupSuccess
mov byte [esp + 0x164], 0xb
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push str.ClientSetup
mov byte [esp + 0x168], 0xc
call fcn.004053e0
mov ecx, dword [esi + 0x14c]
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x168], bl
call fcn.0040b530
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x15c], 0xd
call fcn.00401a20
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x158], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4077f1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ebx, dword [esp + 0x24]
mov eax, dword [esi + 0x15c]
push ebx
push eax
lea ecx, [esp + 0x20]
push str._s_s
push ecx
call fcn.00401ad0
mov ebp, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
add esp, 0x10
push 0x24
push ebp
push edx
mov ecx, esi
call fcn.004274bd
mov edi, eax
sub edi, 6
neg edi
sbb edi, edi
lea eax, [ebx - 0x10]
inc edi
mov byte [esp + 0x158], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40784e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
add ebp, 0xfffffff0
mov byte [esp + 0x158], 2
lea eax, [ebp + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407871
mov ecx, dword [ebp]
mov edx, dword [ecx]
push ebp
call dword [edx + 4]
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x158], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407897
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x158], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408322
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp 0x408322
xor edi, edi
jmp 0x408322
mov eax, dword [esi + 0x74]
test eax, eax
jne 0x407b59
mov eax, dword [esi + 0x144]
test eax, eax
jne 0x407b4e
call fcn.00425d0d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x158], 0xe
call fcn.00425d0d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
mov bl, 0xf
push 0x435578
mov byte [esp + 0x160], bl
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Msg_ProcessError_Setup
mov byte [esp + 0x164], 0x10
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Public
mov byte [esp + 0x168], 0x11
call fcn.004053e0
mov ecx, dword [esi + 0x14c]
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x168], bl
call fcn.0040b530
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x15c], 0x12
call fcn.00401a20
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x158], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4079ae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x435554
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Msg_SetupError
mov byte [esp + 0x164], 0x13
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Public
mov byte [esp + 0x168], 0x14
call fcn.004053e0
mov ecx, dword [esi + 0x14c]
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x168], bl
call fcn.0040b530
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x15c], 0x15
call fcn.00401a20
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x158], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407a3f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4352f8
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.IDERROR
mov byte [esp + 0x164], 0x16
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Public
mov byte [esp + 0x168], 0x17
call fcn.004053e0
mov ecx, dword [esi + 0x14c]
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x168], bl
call fcn.0040b530
push 0x435540
lea ecx, [esp + 0x18]
mov byte [esp + 0x15c], 0x18
call fcn.004053a0
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp - 0xc]
push eax
push ebp
lea ecx, [esp + 0x1c]
call fcn.004047d0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
push 0
push ecx
push edx
mov ecx, esi
call fcn.004274bd
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x158], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407af9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
add ebp, 0xfffffff0
mov byte [esp + 0x158], 0xe
lea eax, [ebp + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x407b1c
mov ecx, dword [ebp]
mov edx, dword [ecx]
push ebp
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x158], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407b59
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, esi
call fcn.00403150
jmp 0x408322
push 0x435524
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, esi
call fcn.00403150
jmp 0x408322
cmp ebp, 2
jne 0x407e34
push 1
mov ecx, esi
call fcn.00404280
push 0xbb8
call ebx
mov ecx, esi
call fcn.00405290
test eax, eax
mov ecx, esi
je 0x407bf2
mov dword [esp + 0x2c], 0
call fcn.00406360
push str.HKAPP
push 0
mov edi, eax
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x1f4
mov ebp, eax
call ebx
test ebp, ebp
jne 0x407bd8
mov ebp, 5
lea esp, [esp]
mov eax, dword [esp + 0x2c]
cmp eax, ebp
jg 0x407be8
mov ecx, eax
inc ecx
push 0x1f4
mov dword [esp + 0x30], ecx
call ebx
jmp 0x407bc0
push 0
push 0
push 0x8818
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
push str.dll_lock
jmp 0x40831c
push 2
call fcn.00405cd0
test eax, eax
jne 0x407c04
mov ecx, esi
call fcn.00403f30
push 2
mov ecx, esi
call fcn.00406860
test eax, eax
je 0x407c31
push str.dll_unlock
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, esi
call fcn.00406360
mov ecx, esi
mov edi, eax
call fcn.00402b00
jmp 0x408322
mov eax, dword [esi + 0x74]
test eax, eax
jne 0x407e28
mov eax, dword [esi + 0x144]
test eax, eax
jne 0x407e1d
lea ecx, [esp + 0x14]
call fcn.00401760
lea ecx, [esp + 0x2c]
call fcn.00401760
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
mov bl, 0x1a
push 0x4354f8
mov byte [esp + 0x160], bl
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Msg_ProcessError_Update
mov byte [esp + 0x164], 0x1b
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Public
mov byte [esp + 0x168], 0x1c
call fcn.004053e0
mov ecx, dword [esi + 0x14c]
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x168], bl
call fcn.0040b530
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x15c], 0x1d
call fcn.00401a20
lea ecx, [esp + 0x10]
mov byte [esp + 0x158], bl
call fcn.004015e0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4354d4
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Msg_UpdateError
mov byte [esp + 0x164], 0x1e
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Public
mov byte [esp + 0x168], 0x1f
call fcn.004053e0
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0x14c]
mov byte [esp + 0x168], bl
call fcn.0040b530
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x15c], 0x20
call fcn.00401a20
lea ecx, [esp + 0x10]
mov byte [esp + 0x158], bl
call fcn.004015e0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4352f8
call fcn.004053e0
push ecx
mov byte [esp + 0x160], 0x21
mov ecx, esp
mov dword [esp + 0x28], esp
push str.IDERROR
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Public
mov byte [esp + 0x168], 0x22
call fcn.004053e0
mov ecx, dword [esi + 0x14c]
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0x168], bl
call fcn.0040b530
push 0x435540
lea ecx, [esp + 0x18]
mov byte [esp + 0x15c], 0x23
call fcn.004053a0
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
call fcn.00405030
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push 0
push ecx
push edx
mov ecx, esi
call fcn.004274bd
lea ecx, [esp + 0x18]
call fcn.004015e0
lea ecx, [esp + 0x2c]
call fcn.004015e0
lea ecx, [esp + 0x14]
mov byte [esp + 0x158], 0
call fcn.004015e0
mov ecx, esi
call fcn.00403150
jmp 0x408322
push 0x4354a8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, esi
call fcn.00403150
jmp 0x408322
cmp ebp, 3
jne 0x4084d0
push 1
mov ecx, esi
call fcn.00404280
mov ecx, esi
call fcn.00405290
test eax, eax
mov ecx, esi
je 0x407eb3
mov dword [esp + 0x2c], 0
call fcn.00406360
push str.HKAPP
push 0
mov edi, eax
call dword [sym.imp.USER32.dll_FindWindowA]
push 0x1f4
mov ebp, eax
call ebx
test ebp, ebp
jne 0x407e99
mov ebp, 5
mov eax, dword [esp + 0x2c]
cmp eax, ebp
jg 0x407ea9
mov ecx, eax
inc ecx
push 0x1f4
mov dword [esp + 0x30], ecx
call ebx
jmp 0x407e81
push 0
push 0
push 0x8818
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
push str.ll_lock
jmp 0x40831c
push 3
call fcn.00405cd0
test eax, eax
jne 0x407ec5
mov ecx, esi
call fcn.00403f30
push 3
mov ecx, esi
call fcn.00406860
test eax, eax
je 0x408155
xor ebx, ebx
push ebx
mov ecx, esi
call fcn.00403380
push str.SOFTWAREGreatSkyDes
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [esi + 0x7c], ebx
jne 0x408322
mov eax, dword [esi + 0x144]
test eax, eax
jne 0x4078c6
lea ecx, [esp + 0x24]
call fcn.00401760
lea ecx, [esp + 0x18]
call fcn.00401760
lea ecx, [esp + 0x2c]
call fcn.00401760
lea ecx, [esp + 0x14]
call fcn.00401760
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
mov bl, 0x27
push 0x435494
mov byte [esp + 0x160], bl
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Msg_UninstallSuccess
mov byte [esp + 0x164], 0x28
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push str.ClientSetup
mov byte [esp + 0x168], 0x29
call fcn.004053e0
mov ecx, dword [esi + 0x14c]
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x168], bl
call fcn.0040b530
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x15c], 0x2a
call fcn.00401a20
lea ecx, [esp + 0x10]
mov byte [esp + 0x158], bl
call fcn.004015e0
mov ecx, dword [esi + 0x160]
mov edx, dword [esp + 0x14]
push ecx
push edx
lea eax, [esp + 0x2c]
push str._s_s
push eax
call fcn.00401ad0
add esp, 0xc
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x435230
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Msg_AskRestart
mov byte [esp + 0x164], 0x2b
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push str.ClientSetup
mov byte [esp + 0x168], 0x2c
call fcn.004053e0
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0x14c]
mov byte [esp + 0x168], bl
call fcn.0040b530
mov byte [esp + 0x158], 0x2d
push eax
lea ecx, [esp + 0x1c]
call fcn.00401a20
lea ecx, [esp + 0x10]
mov byte [esp + 0x158], bl
call fcn.004015e0
push str._r_n_r_n
lea ecx, [esp + 0x28]
call fcn.004053a0
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x28]
call fcn.00405030
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x43520c
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Msg_DesSetupSuccess
mov byte [esp + 0x164], 0x2e
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push str.ClientSetup
mov byte [esp + 0x168], 0x2f
call fcn.004053e0
mov ecx, dword [esi + 0x14c]
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x168], bl
call fcn.0040b530
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x15c], 0x30
call fcn.00401a20
lea ecx, [esp + 0x10]
mov byte [esp + 0x158], bl
call fcn.004015e0
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x15c]
push ecx
push edx
lea eax, [esp + 0x34]
push str._s_s
push eax
call fcn.00401ad0
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
add esp, 0x10
push 0x24
push ecx
push edx
mov ecx, esi
call fcn.004274bd
mov edi, eax
sub edi, 6
neg edi
sbb edi, edi
lea ecx, [esp + 0x14]
inc edi
call fcn.004015e0
lea ecx, [esp + 0x2c]
call fcn.004015e0
lea ecx, [esp + 0x18]
call fcn.004015e0
lea ecx, [esp + 0x24]
mov byte [esp + 0x158], 0
call fcn.004015e0
jmp 0x408322
mov eax, dword [esi + 0x7c]
test eax, eax
jne 0x408322
mov eax, dword [esi + 0x144]
test eax, eax
jne 0x408317
lea ecx, [esp + 0x24]
call fcn.00401760
lea ecx, [esp + 0x18]
call fcn.00401760
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
mov bl, 0x32
push 0x435468
mov byte [esp + 0x160], bl
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Msg_ProcessError_Uninstall
mov byte [esp + 0x164], 0x33
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Public
mov byte [esp + 0x168], 0x34
call fcn.004053e0
mov ecx, dword [esi + 0x14c]
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x168], bl
call fcn.0040b530
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x15c], 0x35
call fcn.00401a20
lea ecx, [esp + 0x10]
mov byte [esp + 0x158], bl
call fcn.004015e0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x435440
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Msg_UninstallError
mov byte [esp + 0x164], 0x36
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Public
mov byte [esp + 0x168], 0x37
call fcn.004053e0
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0x14c]
mov byte [esp + 0x168], bl
call fcn.0040b530
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x15c], 0x38
call fcn.00401a20
lea ecx, [esp + 0x10]
mov byte [esp + 0x158], bl
call fcn.004015e0
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4352f8
call fcn.004053e0
push ecx
mov byte [esp + 0x160], 0x39
mov ecx, esp
mov dword [esp + 0x28], esp
push str.IDERROR
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Public
mov byte [esp + 0x168], 0x3a
call fcn.004053e0
mov ecx, dword [esi + 0x14c]
lea edx, [esp + 0x38]
push edx
mov byte [esp + 0x168], bl
call fcn.0040b530
push 0x435540
lea ecx, [esp + 0x28]
mov byte [esp + 0x15c], 0x3b
call fcn.004053a0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x28]
call fcn.00405030
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
push 0
push ecx
push edx
mov ecx, esi
call fcn.004274bd
jmp 0x40812d
push 0x435410
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, esi
call fcn.00403550
test edi, edi
je 0x408498
lea eax, [esp + 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4084d0
lea eax, [esp + 0x2c]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x408392
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov dword [esp + 0x158], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x4084ef
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
push 0
push 0
push 0x10
lea edx, [esp + 0x48]
push edx
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x28]
push 0
push eax
mov dword [esp + 0x54], 1
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x60], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4083d9
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x4353f0
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.ID_CloseWindows
mov byte [esp + 0x164], 0x3c
call fcn.004053e0
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push str.ClientSetup
mov byte [esp + 0x168], 0x3d
call fcn.004053e0
mov ecx, dword [esi + 0x14c]
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x168], 0
call fcn.0040b530
add esi, 0x150
push eax
mov ecx, esi
mov byte [esp + 0x15c], 0x3e
call fcn.00401a20
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x158], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408470
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi]
push eax
lea ecx, [esp + 0x50]
push 0x434d54
push ecx
call fcn.004170ff
add esp, 0xc
push 1
push 0
push 1
lea edx, [esp + 0x58]
push edx
push 0
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownA]
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov dword [esp + 0x158], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4084cc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
xor eax, eax
jmp 0x4084fc
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov dword [esp + 0x158], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4084f9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
or eax, 0xffffffff
mov ecx, dword [esp + 0x150]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x14c]
call fcn.00417188
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14c
ret 4