Function at 0x413782
Capabilities:
Create thread
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push ebx
mov esi, ecx
push esi
push 0x413720
push ebx
push ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x468], eax
cmp eax, ebx
jne 0x4137da
push str.actionerrorvaluespawnthreads
lea ecx, [ebp - 0x18]
call fcn.0043f7b0
push ebx
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.00410896
lea ecx, [ebp - 0x18]
call fcn.0043f790
mov eax, 0x80004005
pop edi
pop esi
pop ebx
leave
ret
cmp dword [esi + 0x2a4], ebx
jne 0x4138fe
cmp dword [esi + 0x8ec], ebx
jne 0x4138fe
cmp dword [esi + 0x2c], ebx
jne 0x413825
cmp dword [esi + 0x2bc], ebx
jne 0x413825
push ebx
push 0x40d003
push ebx
push 0x7f
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
lea ecx, [esi + 4]
mov dword [esi + 0x2bc], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 4]
lea ecx, [ebp - 0xc]
call fcn.0043f500
lea eax, [ebp - 0xc]
push eax
push 0xb0
mov ecx, esi
call fcn.0040e236
cmp byte [ebp - 5], 0xff
lea eax, [ebp - 0xc]
jne 0x413849
mov eax, dword [ebp - 0xc]
push eax
push dword [esi + 0x2bc]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0x640000
push ebx
push 0x401
push 0x3f0
push dword [esi + 0x2bc]
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push esi
push 0xffffffffffffffeb
push dword [esi + 0x2bc]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 5
push dword [esi + 0x2bc]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x2bc]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x58]
mov dword [ebp - 0x5c], ebx
rep stosd dword es:[edi], eax
jmp 0x4138da
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
cmp eax, ebx
je 0x4138d3
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4138da
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x468], ebx
jne 0x4138aa
push dword [esi + 0x2bc]
call dword [sym.imp.USER32.dll_DestroyWindow]
lea ecx, [ebp - 0xc]
mov dword [esi + 0x2bc], ebx
call fcn.0043f790
jmp 0x41390d
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esi + 0x468], ebx
jne 0x4138fe
cmp dword [esi + 0x3c], ebx
je 0x4137d0
cmp dword [esi + 0x478], ebx
je 0x4137d0
lea eax, [esi + 0x220]
push 0x47e950
push eax
call fcn.00401046
pop ecx
pop ecx
test al, al
je 0x413b84
push str.inst_configcompat.dll
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
call fcn.00407bf4
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00440090
add esp, 0xc
cmp byte [eax + 7], 0xff
jne 0x413962
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [ebp - 0x18]
mov edi, eax
call fcn.0043f790
lea ecx, [ebp - 0xc]
call fcn.0043f790
mov dword [ebp - 4], ebx
cmp edi, ebx
je 0x41399e
push str.RPIsPlusEnabled
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x413997
call eax
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [esi + 0x2c], ebx
jne 0x413b84
cmp dword [ebp - 4], ebx
je 0x413b84
cmp dword [esi + 0x20], ebx
jne 0x413b84
mov eax, dword [esi + 8]
push 0x461
lea ecx, [esi + 8]
call dword [eax]
cmp eax, 0x45f
jne 0x413afd
push str.actionclickvaluedlg_plus_continue
lea ecx, [ebp - 0x18]
call fcn.0043f7b0
push ebx
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.00410896
lea ecx, [ebp - 0x18]
call fcn.0043f790
mov eax, dword [esi + 8]
push 0x467
lea ecx, [esi + 8]
call dword [eax]
cmp eax, 0x45f
jne 0x413a6a
lea ecx, [ebp - 0xc]
call fcn.0043f500
push ebx
lea eax, [ebp - 0xc]
push eax
push str.CookiesPath
push str.RealMediaSDK
push 0x80000001
call fcn.00402bf4
add esp, 0x14
test eax, eax
je 0x413a41
cmp byte [ebp - 5], 0xff
lea eax, [ebp - 0xc]
jne 0x413a3a
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.actionclickvaluedlg_plus2_continue
lea ecx, [ebp - 0x18]
call fcn.0043f7b0
push ebx
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.00410896
lea ecx, [ebp - 0x18]
call fcn.0043f790
lea ecx, [ebp - 0xc]
jmp 0x413af6
cmp eax, 0x468
jne 0x413ac8
push str.actioncancelvaluedlg_plus2_learnmore
lea ecx, [ebp - 0x18]
call fcn.0043f7b0
push ebx
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.00410896
lea ecx, [ebp - 0x18]
call fcn.0043f790
lea edi, [esi + 0xe0]
mov ecx, edi
call fcn.00401005
push ecx
push ecx
test al, al
jne 0x413aab
mov eax, esp
push edi
push eax
jmp 0x413ab5
lea eax, [esi + 0xd8]
mov ecx, esp
push eax
push ecx
mov ecx, esi
call fcn.0040d17c
call fcn.0040dd49
pop ecx
pop ecx
jmp 0x413b4d
cmp eax, 0x45e
jne 0x413b54
push str.actioncancelvaluedlg_plus2_cancel
lea ecx, [ebp - 0x18]
mov dword [esi + 0x34], 1
call fcn.0043f7b0
push ebx
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.00410896
lea ecx, [ebp - 0x18]
call fcn.0043f790
jmp 0x413b54
cmp eax, 0x45e
jne 0x413b0b
push str.actioncancelvaluedlg_plus_cancel
jmp 0x413b31
cmp eax, 0x460
jne 0x413b4d
push ecx
push ecx
mov ecx, esp
lea eax, [esi + 0xd8]
push eax
push ecx
mov ecx, esi
call fcn.0040d17c
call fcn.0040dd49
pop ecx
pop ecx
push str.actioncancelvaluedlg_plus_upgrade
lea ecx, [ebp - 0x18]
call fcn.0043f7b0
push ebx
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.00410896
lea ecx, [ebp - 0x18]
call fcn.0043f790
mov dword [esi + 0x34], 1
cmp dword [esi + 0x34], ebx
je 0x413b84
mov eax, dword [esi + 0x6c]
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
cmp eax, ebx
je 0x413b73
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x34], 1
mov eax, 0x8000aaa3
jmp 0x4137d5
lea ecx, [esi + 0x2c4]
call fcn.0040a393
test eax, eax
jns 0x413b9d
push str.actionerrorvaluecreatedialog
jmp 0x4137b4
cmp dword [esi + 0x2cc], ebx
je 0x413b93
mov eax, dword [esi + 0x3e8]
cmp eax, dword [esi + 0x3ec]
je 0x413c5e
lea edi, [eax + 0x4c]
lea eax, [edi + 8]
cmp dword [eax - 0x44], ebx
jne 0x413c49
push str.main
push eax
call fcn.00406131
pop ecx
pop ecx
test al, al
jne 0x413c49
push 0x2c
mov ecx, edi
call fcn.0043f540
mov dword [ebp - 8], eax
xor eax, eax
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 8], eax
jl 0x413c49
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push 0x2c
push eax
mov ecx, edi
call fcn.00440130
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi + 0x448]
call fcn.00413658
test eax, eax
je 0x413c16
cmp dword [esi + 0x2c], ebx
je 0x413c2b
lea ecx, [ebp - 0x18]
call fcn.0043f790
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jle 0x413bee
jmp 0x413c49
lea eax, [edi - 0x44]
push eax
lea ecx, [esi + 0x37c]
call fcn.00440950
lea ecx, [ebp - 0x18]
mov dword [edi - 0x3c], 1
call fcn.0043f790
add edi, 0xd4
lea eax, [edi - 0x4c]
cmp eax, dword [esi + 0x3ec]
jne 0x413bba
mov eax, dword [esi + 0x3e8]
cmp eax, dword [esi + 0x3ec]
je 0x413da9
lea edi, [eax + 0x4c]
cmp dword [edi - 0x3c], ebx
jne 0x413d94
lea eax, [edi + 8]
push str.main
push eax
call fcn.00401046
pop ecx
pop ecx
test al, al
jne 0x413d94
push 0x2c
mov ecx, edi
call fcn.0043f540
push edi
mov dword [ebp - 8], eax
push 0x47ea68
lea eax, [edi - 8]
push eax
lea eax, [ebp - 0x30]
push str.Step_list_in_GetConfigStub:
push eax
call fcn.004400e0
add esp, 0xc
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00440090
add esp, 0xc
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00440040
push eax
call fcn.0040d9ba
add esp, 0x10
lea ecx, [ebp - 0x20]
call fcn.0043f790
lea ecx, [ebp - 0x28]
call fcn.0043f790
lea ecx, [ebp - 0x30]
call fcn.0043f790
xor eax, eax
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 8], eax
jl 0x413d94
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push 0x2c
push eax
mov ecx, edi
call fcn.00440130
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi + 0x448]
call fcn.00413658
test eax, eax
je 0x413d7d
cmp dword [esi + 0x2c], ebx
jne 0x413d7d
push str._to_download_list.
lea eax, [edi - 8]
push eax
lea eax, [ebp - 0x40]
push str.Adding
push eax
call fcn.004400e0
add esp, 0xc
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00440090
push eax
call fcn.0040d9ba
add esp, 0x10
lea ecx, [ebp - 0x38]
call fcn.0043f790
lea ecx, [ebp - 0x40]
call fcn.0043f790
lea eax, [edi - 0x44]
push eax
lea ecx, [esi + 0x37c]
call fcn.00440950
mov dword [edi - 0x3c], 1
lea ecx, [ebp - 0x18]
call fcn.0043f790
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jle 0x413d02
add edi, 0xd4
lea eax, [edi - 0x4c]
cmp eax, dword [esi + 0x3ec]
jne 0x413c73
cmp dword [esi + 0x14], ebx
je 0x413e1b
mov edi, 0x47e950
push edi
mov esi, str.Gemini
push esi
call fcn.0040304e
pop ecx
pop ecx
cmp eax, ebx
je 0x413e1b
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push esi
call fcn.0040304e
pop ecx
pop ecx
cmp eax, ebx
je 0x413e1b
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 8]
push 1
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x413e1b
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x4137d5