Function at 0x403b70
Capabilities:
Create process on windows
Download url
Hide graphical window
Query or enumerate registry value
Receive data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x298
mov eax, dword [0x446074]
xor eax, esp
mov dword [esp + 0x294], eax
push esi
push edi
sub esp, 0x18
mov ecx, esp
push 1
push 0x4407d4
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
call fcn.004096c0
push ecx
lea ecx, [esp + 0x3c]
call fcn.004023c0
add esp, 0x1c
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0xc], 0x200
call fcn.0040fc10
mov ecx, str.03000200_0400_0500_0006_000700080009
mov eax, 0x4482b8
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x403c16
test dx, dx
je 0x403c12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x403c16
add eax, 4
add ecx, 4
test dx, dx
jne 0x403bf0
xor eax, eax
jmp 0x403c1b
sbb eax, eax
or eax, 1
test eax, eax
je 0x403cfb
mov ecx, str.12345678_1234_5678_90AB_CDDEEFAABBCC
mov eax, 0x4482b8
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x403c56
test dx, dx
je 0x403c52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x403c56
add eax, 4
add ecx, 4
test dx, dx
jne 0x403c30
xor eax, eax
jmp 0x403c5b
sbb eax, eax
or eax, 1
test eax, eax
je 0x403cfb
mov ecx, str.00000000_0000_0000_0000_000000000000
mov eax, 0x4482b8
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x403c96
test dx, dx
je 0x403c92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x403c96
add eax, 4
add ecx, 4
test dx, dx
jne 0x403c70
xor eax, eax
jmp 0x403c9b
sbb eax, eax
or eax, 1
test eax, eax
je 0x403cfb
mov ecx, str.FFFFFFFF_FFFF_FFFF_FFFF_FFFFFFFFFFFF
mov eax, 0x4482b8
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x403cd6
test dx, dx
je 0x403cd2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x403cd6
add eax, 4
add ecx, 4
test dx, dx
jne 0x403cb0
xor eax, eax
jmp 0x403cdb
sbb eax, eax
or eax, 1
test eax, eax
je 0x403cfb
mov ecx, 0x4482b8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403ce7
sub ecx, edx
sar ecx, 1
cmp ecx, 0x24
je 0x403d68
lea eax, [esp + 0x1c]
push eax
push 0x101
push 0
push str.SOFTWAREMicrosoftCryptography
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x9c]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push str.MachineGuid
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x98]
push eax
call fcn.0041b540
add esp, 4
push eax
push str._wsX
push 0x4482b8
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [esp + 0x20]
call fcn.004071f0
test al, al
je 0x403e92
call fcn.0040f9a0
mov ecx, eax
test ecx, ecx
je 0x4049aa
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], eax
mov eax, 0x440c2c
test eax, 0xffff0000
jne 0x403db1
movzx eax, ax
push eax
call fcn.0040b640
jmp 0x403dbb
push 0x440c2c
call fcn.00407290
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0xc]
mov dword [esp + 0x18], eax
cmp eax, dword [esp + 0x2c]
je 0x403e41
mov ecx, dword [esi - 0x10]
lea edi, [esi - 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
cmp dword [edi + 0xc], 0
mov ecx, eax
lea eax, [edi + 0xc]
jl 0x403dfc
cmp ecx, dword [edi]
jne 0x403dfc
lock inc dword [eax]
mov ecx, dword [esp + 0x18]
lea eax, [edi + 0x10]
mov dword [ecx], eax
add dword [esp + 0x28], 4
jmp 0x403e50
mov eax, dword [ecx]
push 2
push dword [edi + 4]
mov eax, dword [eax]
call eax
mov dword [esp + 0x1c], eax
test eax, eax
je 0x4049a5
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
lea ecx, [edi + 0x10]
mov edx, dword [edi + 4]
inc edx
push edx
push ecx
lea ecx, [eax + 0x10]
call fcn.0040b880
mov edi, dword [esp + 0x24]
add esp, 8
mov ecx, dword [esp + 0x18]
lea eax, [edi + 0x10]
mov dword [ecx], eax
add dword [esp + 0x28], 4
jmp 0x403e50
lea ecx, [esp + 0xc]
push ecx
push eax
lea ecx, [esp + 0x2c]
call fcn.0040d360
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x403e68
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x20]
push ecx
cmp eax, dword [esp + 0x30]
je 0x403e88
mov edx, eax
call fcn.0040d550
add esp, 4
add dword [esp + 0x28], 4
jmp 0x403e92
push eax
lea ecx, [esp + 0x2c]
call fcn.0040d5c0
call fcn.0040f9a0
mov ecx, eax
test ecx, ecx
je 0x4049aa
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
push str.Installer:_Start_n
mov dword [esp + 0x18], eax
call fcn.0040fac0
add esp, 4
push str.Welcome:_Show_n
call fcn.0040fac0
add esp, 4
push 0
push 0x410070
push 0
push 0x67
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
xorps xmm0, xmm0
mov dword [esp + 0x50], 0
push 0
lea eax, [esp + 0x3c]
movaps xmmword [esp + 0x3c], xmm0
push eax
movq qword [esp + 0x50], xmm0
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x403f4c
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageW]
nop dword [eax]
cmp byte [0x4484b9], 0
jne 0x403f4c
lea eax, [esp + 0x30]
push eax
call esi
lea eax, [esp + 0x30]
push eax
call edi
push 0
push 0
push 0
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x403f20
push str.Welcome:_Done_n
call fcn.0040fac0
add esp, 4
xor eax, eax
sub esp, 0x18
mov ecx, esp
push eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 7
mov word [ecx], ax
push 0x4411d0
cmp byte [0x4484b8], al
jne 0x404092
call fcn.004093f0
sub esp, 0xc
lea eax, [esp + 0x48]
mov ecx, esp
push eax
call fcn.00405b80
push ecx
mov byte [esp + 0x38], 1
mov esi, esp
call fcn.0040f9a0
mov ecx, eax
test ecx, ecx
je 0x4049aa
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov ecx, esi
mov dword [esi], eax
mov eax, str.mini_start
test eax, 0xffff0000
jne 0x403fcf
movzx eax, ax
push eax
call fcn.0040b640
jmp 0x403fdb
push 0xa
push str.mini_start
call fcn.0040b910
mov cl, byte [esp + 0x38]
call fcn.00402e20
add esp, 0x10
xor eax, eax
mov ecx, esp
push eax
push 0x4411d0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.004093f0
sub esp, 0xc
mov byte [esp + 0x34], 0
mov eax, esp
push ecx
mov dword [eax], 0
mov esi, esp
mov dword [eax + 4], 0
mov dword [eax + 8], 0
call fcn.0040f9a0
mov ecx, eax
test ecx, ecx
je 0x4049aa
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov ecx, esi
mov dword [esi], eax
mov eax, str.mini_quit
test eax, 0xffff0000
jne 0x404070
movzx eax, ax
push eax
call fcn.0040b640
mov cl, byte [esp + 0x38]
call fcn.00402e20
or esi, 0xffffffff
add esp, 0x28
or edi, esi
jmp 0x4048b3
push 9
push str.mini_quit
call fcn.0040b910
mov cl, byte [esp + 0x38]
call fcn.00402e20
or esi, 0xffffffff
add esp, 0x28
or edi, esi
jmp 0x4048b3
call fcn.004093f0
sub esp, 0xc
lea eax, [esp + 0x48]
mov ecx, esp
push eax
call fcn.00405b80
push ecx
mov byte [esp + 0x38], 1
mov esi, esp
call fcn.0040f9a0
mov ecx, eax
test ecx, ecx
je 0x4049aa
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov ecx, esi
mov dword [esi], eax
mov eax, str.mini_start
test eax, 0xffff0000
jne 0x4040e2
movzx eax, ax
push eax
call fcn.0040b640
jmp 0x4040ee
push 0xa
push str.mini_start
call fcn.0040b910
mov cl, byte [esp + 0x38]
call fcn.00402e20
push str.TEMP
mov byte [esp + 0x3c], al
call fcn.0041ba08
mov edx, eax
add esp, 0x2c
test edx, edx
jne 0x404112
xor ecx, ecx
jmp 0x404126
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404117
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, 0x4484bc
call fcn.0040b910
mov eax, dword [0x4484bc]
mov ecx, 0x4411d0
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404166
test dx, dx
je 0x404162
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404166
add eax, 4
add ecx, 4
test dx, dx
jne 0x404140
xor eax, eax
jmp 0x40416b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4041eb
push eax
push eax
push 0xffffffffffffffff
push 0x440c90
push eax
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax - 1]
test edi, edi
jle 0x4041e1
mov edx, dword [0x4484bc]
mov esi, 1
mov eax, dword [edx - 8]
sub esi, dword [edx - 4]
sub eax, edi
or eax, esi
jge 0x4041b0
push edi
mov ecx, 0x4484bc
call fcn.0040bb10
mov edx, dword [0x4484bc]
push edi
push edx
push 0xffffffffffffffff
push 0x440c90
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [0x4484bc]
cmp edi, dword [eax - 8]
jg 0x4049b4
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [0x4484bc]
mov word [eax + edi*2], cx
jmp 0x4041eb
mov ecx, 0x4484bc
call fcn.00409890
push 0x4482b8
push 0x440c94
call fcn.0040fac0
add esp, 8
cmp byte [esp + 0x10], 0
jne 0x404226
push 0
push 0
push 0
push str.https:__veryfast.io_installerror.html_reasoninstaller_no_comm
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or esi, 0xffffffff
or edi, esi
jmp 0x4048b3
push str.installer:_Open_installing.html_n
call fcn.0040fb20
add esp, 4
call fcn.0040f9a0
mov ecx, eax
test ecx, ecx
je 0x4049aa
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
push 0x4482b8
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push str.https:__veryfast.io_installing.html_guid_ws
push eax
call fcn.0040bd00
add esp, 0xc
call fcn.004037f0
mov esi, dword [esp + 0x1c]
push 0
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
sub esp, 0x18
xor eax, eax
mov ecx, esp
push eax
push 0x4411d0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.004093f0
sub esp, 0xc
mov byte [esp + 0x34], 1
mov eax, esp
push ecx
mov dword [eax], 0
mov edi, esp
mov dword [eax + 4], 0
mov dword [eax + 8], 0
call fcn.0040f9a0
mov ecx, eax
test ecx, ecx
je 0x4049aa
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov ecx, edi
mov dword [edi], eax
mov eax, str.mini_dl_eng_start
test eax, 0xffff0000
jne 0x4042fc
movzx eax, ax
push eax
call fcn.0040b640
jmp 0x404308
push 0x11
push str.mini_dl_eng_start
call fcn.0040b910
mov cl, byte [esp + 0x38]
call fcn.00402e20
mov edi, dword [0x4484bc]
add esp, 0x28
add edi, 0xfffffff0
mov ecx, dword [edi]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
cmp dword [edi + 0xc], 0
mov ecx, eax
lea eax, [edi + 0xc]
jl 0x40433a
cmp ecx, dword [edi]
jne 0x40433a
lock inc dword [eax]
jmp 0x404371
mov eax, dword [ecx]
push 2
push dword [edi + 4]
mov eax, dword [eax]
call eax
mov ecx, eax
mov dword [esp + 0xc], ecx
test ecx, ecx
je 0x4049a5
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea eax, [edi + 0x10]
mov edx, dword [edi + 4]
add ecx, 0x10
inc edx
push edx
push eax
call fcn.0040b880
mov edi, dword [esp + 0x14]
add esp, 8
push 0x10
lea eax, [edi + 0x10]
push str.SetupEngine.exe
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
call fcn.0040bb80
push 0x2f
push str.https:__veryfast.io_download.php_engine1guid
lea ecx, [esp + 0x1c]
call fcn.0040b910
mov ecx, 0x4482b8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4043a0
sub ecx, edx
sar ecx, 1
push ecx
push 0x4482b8
lea ecx, [esp + 0x1c]
call fcn.0040bb80
lea ecx, [esp + 0x20]
call fcn.004071f0
test al, al
je 0x4043ec
push 7
push str._fcid
lea ecx, [esp + 0x1c]
call fcn.0040bb80
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push dword [eax - 0xc]
push eax
call fcn.0040bb80
mov edi, dword [esp + 0xc]
push 0
push 0
push edi
push dword [esp + 0x20]
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
sub esp, 0x18
mov ecx, esp
push 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 0x4411d0
test eax, eax
jne 0x404908
mov word [ecx], ax
call fcn.004093f0
sub esp, 0xc
mov byte [esp + 0x34], 1
mov eax, esp
push ecx
mov dword [eax], 0
mov esi, esp
mov dword [eax + 4], 0
mov dword [eax + 8], 0
call fcn.0040f9a0
mov ecx, eax
test ecx, ecx
je 0x4049aa
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov ecx, esi
mov dword [esi], eax
mov eax, str.mini_dl_eng_success
test eax, 0xffff0000
jne 0x404480
movzx eax, ax
push eax
call fcn.0040b640
jmp 0x40448c
push 0x13
push str.mini_dl_eng_success
call fcn.0040b910
mov cl, byte [esp + 0x38]
call fcn.00402e20
push str.Installer:_Staring_main_installer_n
call fcn.0040fac0
add esp, 0x2c
call fcn.0040f9a0
mov ecx, eax
test ecx, ecx
je 0x4049aa
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, 0x4411d0
test eax, 0xffff0000
jne 0x4044da
movzx eax, ax
push eax
call fcn.0040b640
jmp 0x4044e6
push 0
push 0x4411d0
call fcn.0040b910
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x5c]
xorps xmm0, xmm0
mov dword [esp + 0x5c], 0x3c
push eax
movlpd qword [esp + 0x84], xmm0
movlpd qword [esp + 0x8c], xmm0
movlpd qword [esp + 0x94], xmm0
mov dword [esp + 0x64], 0x40
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], edi
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 5
mov dword [esp + 0x80], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [esp + 0x98]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x94]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
lea ecx, [esp + 0x10]
call fcn.00407320
push 0xa
push str.Setup.exe
lea ecx, [esp + 0x14]
call fcn.0040bb80
push 0x2c
push str.https:__pcapp.store_download.php_cpg1guid
lea ecx, [esp + 0x1c]
call fcn.0040b910
mov ecx, 0x4482b8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4045a4
sub ecx, edx
sar ecx, 1
push ecx
push 0x4482b8
lea ecx, [esp + 0x1c]
call fcn.0040bb80
lea ecx, [esp + 0x20]
call fcn.004071f0
test al, al
je 0x4045f0
push 7
push str._fcid
lea ecx, [esp + 0x1c]
call fcn.0040bb80
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x14]
push dword [eax - 0xc]
push eax
call fcn.0040bb80
mov edi, dword [esp + 0xc]
push 0
push 0
push edi
push dword [esp + 0x20]
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x4047bb
mov ecx, dword [esi - 0x10]
test ecx, ecx
je 0x40461f
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
test eax, eax
jne 0x40462d
call fcn.0040f9a0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
push eax
push ecx
lea ecx, [esp + 0x10]
call fcn.004097f0
mov eax, dword [esp + 8]
test eax, eax
je 0x4049aa
mov edx, eax
mov ecx, esi
nop dword [eax + eax]
mov si, word [ecx]
cmp si, word [edx]
mov esi, dword [esp + 0x18]
jne 0x40468d
cmp word [ecx], 0
je 0x404683
mov di, word [ecx + 2]
cmp di, word [edx + 2]
mov word [esp + 0x10], di
mov edi, dword [esp + 0xc]
jne 0x40468d
add ecx, 4
add edx, 4
cmp word [esp + 0x10], 0
jne 0x404650
mov dword [esp + 0xc], 0
jmp 0x404696
sbb ecx, ecx
or ecx, 1
mov dword [esp + 0xc], ecx
lea edx, [eax - 0x10]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4046ae
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [esp + 0xc], 0
jne 0x4046d2
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0
push str._internal
push edi
push str.open
push 0
call eax
jmp 0x4047bb
mov ecx, dword [esi - 0x10]
test ecx, ecx
je 0x4046e6
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x4046fe
call fcn.0040f9a0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x4049aa
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], esi
mov ecx, dword [eax - 0xc]
mov dword [esp + 0xc], ecx
lea edx, [ecx + 0xa]
test edx, edx
js 0x4049b4
mov ecx, 1
sub ecx, dword [esi - 4]
mov dword [esp + 8], ecx
mov ecx, dword [esi - 8]
sub ecx, edx
or ecx, dword [esp + 8]
jge 0x40474b
push edx
lea ecx, [esp + 0x14]
call fcn.0040bb10
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
mov edx, ecx
push ecx
push eax
mov ecx, esi
call fcn.0040b880
mov eax, dword [esp + 0x14]
mov edx, 0xa
push 0xa
push str.__internal
lea ecx, [esi + eax*2]
call fcn.0040b880
mov eax, dword [esp + 0x1c]
add esp, 0x10
add eax, 0xa
cmp eax, dword [esi - 8]
jg 0x4049b4
xor ecx, ecx
mov dword [esi - 0xc], eax
push ecx
push ecx
push esi
push edi
push str.open
mov word [esi + eax*2], cx
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ecx
call eax
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4047b7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [esp + 0x18]
sub esp, 0x18
xor eax, eax
mov ecx, esp
push eax
push 0x4411d0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov word [ecx], ax
call fcn.004093f0
sub esp, 0xc
mov byte [esp + 0x34], 1
mov eax, esp
push ecx
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [esp + 0x30], esp
call fcn.0040f9a0
mov ecx, eax
test ecx, ecx
je 0x4049aa
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
mov ecx, dword [esp + 0x30]
add eax, 0x10
mov dword [ecx], eax
mov eax, str.mini_done
test eax, 0xffff0000
jne 0x404837
movzx eax, ax
push eax
call fcn.0040b640
jmp 0x404843
push 9
push str.mini_done
call fcn.0040b910
mov cl, byte [esp + 0x38]
call fcn.00402e20
push str.Installer:_Done_n
call fcn.0040fac0
add esp, 0x2c
mov dword [esp + 0xc], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x404879
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [esp + 0x1c]
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x404895
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
or edi, 0xffffffff
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4048af
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4048ce
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [esp + 0x24]
call fcn.00408e30
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x4048f0
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [esp + 0x29c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.004127e5
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
mov word [ecx], ax
call fcn.004093f0
sub esp, 0xc
mov byte [esp + 0x34], 1
mov eax, esp
push ecx
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [esp + 0x30], esp
call fcn.0040f9a0
mov ecx, eax
test ecx, ecx
je 0x4049aa
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
mov ecx, dword [esp + 0x30]
add eax, 0x10
mov dword [ecx], eax
mov eax, str.mini_dl_eng_failed
test eax, 0xffff0000
jne 0x404967
movzx eax, ax
push eax
call fcn.0040b640
jmp 0x404973
push 0x12
push str.mini_dl_eng_failed
call fcn.0040b910
mov cl, byte [esp + 0x38]
call fcn.00402e20
mov eax, dword [sym.imp.SHELL32.dll_ShellExecuteW]
add esp, 0x28
push 0
push 0
push 0
push str.https:__veryfast.io_installerror.html_guid_wsreasoninstaller_cannot_download_engine
push str.open
push 0
call eax
mov dword [esp + 0xc], 0xffffffff
jmp 0x40487d
call fcn.0040bb70
push 0x80004005
call fcn.0040f780
push 0x80070057
call fcn.0040f780
int3