Function at 0x404da0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x549642
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x16dc
call fcn.00532b40
mov eax, dword [0x5ad040]
xor eax, esp
mov dword [esp + 0x16d8], eax
push ebx
push esi
push edi
mov eax, dword [0x5ad040]
xor eax, esp
push eax
lea eax, [esp + 0x16f0]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x14], ebx
push 0
call fcn.00419ba5
mov ecx, ebx
call fcn.00406290
lea ecx, [ebx + 0xa8]
call fcn.004093d0
cmp eax, 0xffffffff
jne 0x404e24
push 0
push str.Installation_Error
push str.MSI____.__.
mov ecx, ebx
call fcn.004159e9
or eax, 0xffffffff
jmp 0x405413
cmp dword [ebx + 0x2198], 0xffffffff
jne 0x404e48
push 0
push str.Installation_Error
push 0x58d248
mov ecx, ebx
call fcn.004159e9
or eax, 0xffffffff
jmp 0x405413
push 0x7d0
lea eax, [esp + 0x748]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp byte [ebx + 0x21ab], 0
je 0x4050e8
lea eax, [esp + 0x744]
push eax
lea ecx, [esp + 0xb8]
call fcn.00406480
push 1
sub esp, 8
mov dword [esp + 0x1704], 0
lea ecx, [esp + 0xc0]
call fcn.00406750
push eax
push ecx
lea eax, [esp + 0xd4]
push eax
lea ecx, [esp + 0xc0]
call fcn.00406550
mov esi, eax
lea eax, [esp + 0xb4]
cmp eax, esi
je 0x404f03
cmp dword [esp + 0xc8], 8
jb 0x404ed6
push dword [esp + 0xb4]
call fcn.0040f8c3
add esp, 4
xor eax, eax
mov dword [esp + 0xc8], 7
push esi
lea ecx, [esp + 0xb8]
mov dword [esp + 0xc8], 0
mov word [esp + 0xb8], ax
call fcn.00406610
cmp dword [esp + 0xe0], 8
jb 0x404f1c
push dword [esp + 0xcc]
call fcn.0040f8c3
add esp, 4
push 0x14
push str.InstallerConfig.ini
lea ecx, [esp + 0xbc]
call fcn.00406670
cmp dword [esp + 0xc8], 8
lea eax, [esp + 0xb4]
lea ecx, [esp + 0x10]
cmovae eax, dword [esp + 0xb4]
push eax
call fcn.00402750
mov byte [esp + 0x16f8], 1
call fcn.00412b6d
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x404f74
push 0x80004005
call fcn.00402af0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x16f8], 2
call fcn.00412b6d
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x404fa6
push 0x80004005
call fcn.00402af0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x16f8], 3
call fcn.00412b6d
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x404fd8
push 0x80004005
call fcn.00402af0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
push 7
push str.Install
lea ecx, [esp + 0x24]
mov byte [esp + 0x1700], 4
call fcn.00402650
push 4
push str.BNDL
lea ecx, [esp + 0x20]
call fcn.00402650
push 1
push 0x58d2e0
lea ecx, [esp + 0x28]
call fcn.00402650
push dword [esp + 0x10]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea edx, [esi - 0x10]
mov byte [esp + 0x16f8], 3
or esi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x40505b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [esp + 0x16f8], 2
mov ecx, esi
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40507c
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov byte [esp + 0x16f8], 1
mov ecx, esi
lea eax, [ebx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40509d
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0x16f8], 0
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x4050c0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x16f8], 0xffffffff
cmp dword [esp + 0xc8], 8
jb 0x4050e4
push dword [esp + 0xb4]
call fcn.0040f8c3
add esp, 4
mov ebx, dword [esp + 0x14]
lea eax, [esp + 0x744]
push eax
lea ecx, [esp + 0xa0]
call fcn.00406480
push 1
sub esp, 8
mov dword [esp + 0x1704], 5
lea ecx, [esp + 0xa8]
call fcn.00406750
push eax
push ecx
lea eax, [esp + 0xd4]
push eax
lea ecx, [esp + 0xa8]
call fcn.00406550
mov esi, eax
lea eax, [esp + 0x9c]
cmp eax, esi
je 0x405181
cmp dword [esp + 0xb0], 8
jb 0x405154
push dword [esp + 0x9c]
call fcn.0040f8c3
add esp, 4
xor eax, eax
mov dword [esp + 0xb0], 7
push esi
lea ecx, [esp + 0xa0]
mov dword [esp + 0xb0], 0
mov word [esp + 0xa0], ax
call fcn.00406610
cmp dword [esp + 0xe0], 8
jb 0x40519a
push dword [esp + 0xcc]
call fcn.0040f8c3
add esp, 4
push 0x1a
push 0x58d2e4
lea ecx, [esp + 0xa4]
call fcn.00406670
cmp byte [ebx + 0x21aa], 1
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jne 0x40526f
cmp dword [esp + 0xb0], 8
lea eax, [esp + 0x24]
push 0x3c
push 0
lea esi, [esp + 0xa4]
cmovae esi, dword [esp + 0xa4]
push eax
call fcn.00530d50
add esp, 0xc
mov dword [esp + 0x24], 0x3c
cmp dword [ebx + 0xae4], 0
mov dword [esp + 0x30], str.open
mov dword [esp + 0x34], esi
jne 0x405239
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push str.taskkill__F__T__IM_Hwp.exe
call esi
push 0
push str.taskkill__F__T__IM_HCell.exe
call esi
push 0
push str.taskkill__F__T__IM_HShow.exe
call esi
push 0
push str.taskkill__F__T__IM_Hpdf.exe
call esi
mov dword [esp + 0x38], str._prevuninstall__silent
jmp 0x405241
mov dword [esp + 0x38], str._prevuninstall
lea eax, [esp + 0x24]
mov dword [esp + 0x40], 5
push eax
mov dword [esp + 0x2c], 0x40
call edi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
push dword [esp + 0x60]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebx + 0xae4], 0
jne 0x405370
xor eax, eax
push 0x206
push eax
mov word [esp + 0x544], ax
lea eax, [esp + 0x546]
push eax
call fcn.00530d50
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x548]
add esp, 0xc
push eax
push 1
push 0
push 0x1a
push 0
call esi
push str.HNCUserCommon110_recentInfo.xml
lea eax, [esp + 0x540]
push 0x104
push eax
call fcn.0052f62b
add esp, 0xc
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0x540]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x4052f9
lea eax, [esp + 0x53c]
push eax
call fcn.0052f697
add esp, 4
xor eax, eax
push 0x206
push eax
mov word [esp + 0x33c], ax
lea eax, [esp + 0x33e]
push eax
call fcn.00530d50
add esp, 0xc
lea eax, [esp + 0x334]
push eax
push 1
push 0
push 0x1a
push 0
call esi
push str.HNCUserCommon110_themeInfo.xml
lea eax, [esp + 0x338]
push 0x104
push eax
call fcn.0052f62b
add esp, 0xc
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0x338]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x405370
lea eax, [esp + 0x334]
push eax
call fcn.0052f697
add esp, 4
cmp dword [esp + 0xb0], 8
lea eax, [esp + 0x60]
push 0x3c
push 0
lea esi, [esp + 0xa4]
cmovae esi, dword [esp + 0xa4]
push eax
call fcn.00530d50
add esp, 0xc
mov dword [esp + 0x60], 0x3c
cmp dword [ebx + 0xae4], 0
mov ecx, 0x58d45c
mov eax, str._install__silent
mov dword [esp + 0x6c], str.open
cmovne eax, ecx
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], eax
lea eax, [esp + 0x60]
push eax
mov dword [esp + 0x80], 5
mov dword [esp + 0x68], 0x40
call edi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
push dword [esp + 0x9c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [esp + 0xb0], 8
jb 0x405411
push dword [esp + 0x9c]
call fcn.0040f8c3
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x16f0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x16d8]
xor ecx, esp
call fcn.0052e288
mov esp, ebp
pop ebp
ret