Function at 0x43f040
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Delete file
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x538743
mov eax, dword fs:[0]
push eax
mov eax, 0x2e58
call fcn.004682f0
mov eax, dword [0x657114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2d30], ecx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x237c]
push eax
call fcn.004d4111
add esp, 4
mov dword [ebp - 4], 0
call fcn.004728a5
cmp dword [ebp - 0x236c], 0
sete al
test al, al
jne 0x43f15c
mov dword [ebp - 0x2e04], 0
mov dword [ebp - 0x2e00], 0
mov dword [ebp - 0x2dfc], 0
mov ecx, 0x62
mov byte [ebp - 4], 1
mov esi, str.XRoIh12wjPovVMi4CvpWX4qNbScxmuvOznjxizpamqSUtGLAEALKhR9fpFMJsxPBUayk7NOg75npZGARPn4HBi33wQVtRJEoJw0SWE3XNV09miSLCq5rc9V6cqxNN2pqVrLtgas1rOuqC330oMGBTPwa0EjLUz3bzQJwsMsfN8dk8SDR2Hb3YtznVRIlsukYTRmQ5xtO29AptHeeQv7w4jWyB8CZMeVsyqVZEXbdyoeuQsdsZSf6g4G09hQKGSRVKDTETsxDDBVElr8ruoToBycnSljuB9NaH2UI7Y34ocU5RHITOmkFWqg0yvkN6XPqB0xUZdBDDU4P1L7GtEj8XLuDBrUeNqqHH9QvxTRnXMcdOduIa8HBIliQcGpmfQ1nXyfbIr9z
lea edi, [ebp - 0x1034]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1034]
push eax
lea ecx, [ebp - 0x27cc]
movsb byte es:[edi], byte [esi]
call fcn.00405820
lea eax, [ebp - 0x27cc]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x2e04]
call fcn.00407e30
lea ecx, [ebp - 0x27cc]
mov byte [ebp - 4], 1
call fcn.00405970
cmp dword [ebp - 0x2368], 8
lea ecx, [ebp - 0x237c]
mov eax, dword [ebp - 0x236c]
cmovae ecx, dword [ebp - 0x237c]
movzx eax, word [ecx + eax*2 - 2]
cmp eax, 0x5c
je 0x43f14d
cmp eax, 0x2f
je 0x43f14d
push 0x63d88c
lea ecx, [ebp - 0x237c]
call fcn.00403fa0
lea ecx, [ebp - 0x2e04]
mov byte [ebp - 4], 0
call fcn.004059b0
push 0x5a66e0
lea ecx, [ebp - 0x237c]
call fcn.00403fa0
cmp dword [ebp - 0x2368], 8
lea eax, [ebp - 0x237c]
cmovae eax, dword [ebp - 0x237c]
push eax
call fcn.004c0987
add esp, 4
lea eax, [ebp - 0x2484]
push eax
call fcn.00408f30
mov ecx, eax
call fcn.004115d0
mov byte [ebp - 4], 3
mov dword [ebp - 0x2d44], 0
call fcn.004d07aa
push 0
push eax
lea eax, [ebp - 0x249c]
push eax
call fcn.004c0aec
add esp, 0xc
mov byte [ebp - 4], 4
call fcn.00402160
lea eax, [ebp - 0x2c64]
push 0x36
push eax
call fcn.00408fb0
mov ecx, eax
call fcn.0041a260
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 5
jb 0x43f1eb
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x27e4]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x27e4]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 6
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x27e4]
mov dword [ebp - 0x2dac], eax
call fcn.004024b0
lea ecx, [ebp - 0x2c64]
mov byte [ebp - 4], 4
call fcn.004024b0
lea eax, [ebp - 0x2c94]
push 0x39
push eax
call fcn.00408fb0
mov ecx, eax
call fcn.0041a260
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 7
jb 0x43f24c
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x27fc]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x27fc]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 8
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x27fc]
mov dword [ebp - 0x2d40], eax
call fcn.004024b0
lea ecx, [ebp - 0x2c94]
mov byte [ebp - 4], 4
call fcn.004024b0
push str.InstallOpenRun
lea ecx, [ebp - 0x2814]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2814]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 9
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x2814]
call fcn.004024b0
mov dword [ebp - 0x2e10], 0
mov dword [ebp - 0x2e0c], 0
mov dword [ebp - 0x2e08], 0
mov ecx, 0x3a
mov byte [ebp - 4], 0xa
mov esi, str.4EsAHaw99UhIQvMhaqPY84IPdGu4bG9t3Ky0K5RvjMmlMM5t3WJlFr3PXF68LGCNRTH7EHz9kZGCKW09FcHcqMbX4zoiAQKOETLjqy1YLLkzwSBOKdxq4NsphxPQRxrfbIJdFiCtduTffHQJblCYbrAOU7KVrVKpRgOO59Z1KzkxoIakNS4O1HPhPxuT9bTTMERRo28hubcVWxDc1I11ndl5oYldJB24QuMVD1Gpx
lea edi, [ebp - 0x2b0]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp - 0x282c]
movsw word es:[edi], word [esi]
call fcn.00405820
lea eax, [ebp - 0x282c]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x2e10]
call fcn.00407e30
lea ecx, [ebp - 0x282c]
mov byte [ebp - 4], 0xa
call fcn.00405970
push str.InstallCanInstall
lea ecx, [ebp - 0x2844]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2844]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0xc
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x2844]
mov byte [ebp - 4], 0xa
mov esi, eax
call fcn.004024b0
push str.InstallRunThrough
lea ecx, [ebp - 0x285c]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x285c]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0xd
mov eax, dword [eax + 0x1c]
call eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x285c]
call fcn.004024b0
push str.InstallRunSpecial
lea ecx, [ebp - 0x2874]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2874]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0xe
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x2874]
mov byte [ebp - 4], 0xa
call fcn.004024b0
push str.InstallRunFinish
lea ecx, [ebp - 0x288c]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x288c]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0xf
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x288c]
mov dword [ebp - 0x2d38], eax
mov byte [ebp - 4], 0xa
call fcn.004024b0
push str.DownloadFlag
lea ecx, [ebp - 0x28a4]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x28a4]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x10
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x28a4]
mov dword [ebp - 0x2d3c], eax
mov byte [ebp - 4], 0xa
call fcn.004024b0
xor edi, edi
mov dword [ebp - 0x2d28], edi
call fcn.00402160
mov eax, dword [ebp - 0x2d40]
test eax, eax
je 0x43f49f
cmp dword [eax + 0x14], 8
jb 0x43f454
mov eax, dword [eax]
mov ecx, 0x588c30
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43f486
test dx, dx
je 0x43f482
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43f486
add eax, 4
add ecx, 4
test dx, dx
jne 0x43f460
xor eax, eax
jmp 0x43f48b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43f49f
call fcn.004742e7
mov edi, 1
mov dword [ebp - 0x2d28], edi
call fcn.00402160
test esi, esi
je 0x43f4ed
cmp dword [esi + 0x14], 8
jb 0x43f4b0
mov esi, dword [esi]
mov eax, 0x59e514
mov cx, word [esi]
cmp cx, word [eax]
jne 0x43f4db
test cx, cx
je 0x43f4d7
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x43f4db
add esi, 4
add eax, 4
test cx, cx
jne 0x43f4b5
xor eax, eax
jmp 0x43f4e0
sbb eax, eax
or eax, 1
xor ecx, ecx
test eax, eax
cmove edi, ecx
mov dword [ebp - 0x2d28], edi
mov dword [ebp - 0x2e1c], 0
mov dword [ebp - 0x2e18], 0
mov dword [ebp - 0x2e14], 0
mov ecx, 0x53
mov byte [ebp - 4], 0x11
mov esi, str.yiXWF5kDyZV2Re6FjpRMgs40lclGnqr2BnvhYgNbLG7BzNmtS3m3H36qhm8HmVqmgdLxQuGmuFaVxEek1nhFjwJrK3RfAce2krLW4LftqWqaBhgaQy8v8Mc47WsbAfCP3abDg0HO3733vUMxQlpHWqgGpsNp46czEGbLCCN8yYrBTv6C7RO4YMRcF5BWERsQfOBT9g2iG9jBdOWepfwPm9hgVgabzKLqGDm773kOvMEftMKwqzRH7GplouzLcLD00wA4GnQ7gcmmwpT3F4vf6dduBU93Bjo7TaJH07WlVVry95W0zo7vSgtDzr9FjkqMNn0IMYasFKqd
lea edi, [ebp - 0xa88]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xa88]
push eax
lea ecx, [ebp - 0x28bc]
movsb byte es:[edi], byte [esi]
call fcn.00405820
lea eax, [ebp - 0x28bc]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0x2e1c]
call fcn.00407e30
lea ecx, [ebp - 0x28bc]
call fcn.00405970
mov eax, dword [ebp - 0x2d3c]
mov esi, 1
test eax, eax
je 0x43f5c0
cmp dword [eax + 0x14], 8
jb 0x43f56c
mov eax, dword [eax]
mov ecx, 0x588c30
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43f5a8
test dx, dx
je 0x43f593
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43f5a8
add eax, 4
add ecx, 4
test dx, dx
jne 0x43f571
mov edx, dword [ebp - 0x2d28]
xor eax, eax
test eax, eax
cmove edx, esi
mov dword [ebp - 0x2d28], edx
jmp 0x43f5c6
mov edx, dword [ebp - 0x2d28]
sbb eax, eax
or eax, 1
test eax, eax
cmove edx, esi
mov dword [ebp - 0x2d28], edx
jmp 0x43f5c6
mov edx, dword [ebp - 0x2d28]
mov eax, dword [ebp - 0x2d38]
test eax, eax
je 0x43f618
cmp dword [eax + 0x14], 8
jb 0x43f5d8
mov eax, dword [eax]
mov ecx, 0x588c30
nop dword [eax]
mov si, word [eax]
cmp si, word [ecx]
jne 0x43f606
test si, si
je 0x43f602
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x43f606
add eax, 4
add ecx, 4
test si, si
jne 0x43f5e0
xor eax, eax
jmp 0x43f60b
sbb eax, eax
or eax, 1
xor ecx, ecx
test eax, eax
cmove edx, ecx
mov dword [ebp - 0x2d28], edx
mov dword [ebp - 0x2e28], 0
mov dword [ebp - 0x2e24], 0
mov dword [ebp - 0x2e20], 0
mov ecx, 0x75
mov byte [ebp - 4], 0x13
mov esi, str.vqkqKQ8PMUlar1Lksc7BV44sKwfMxrqroKUZiRYz0u34vtx53WwkXvc631X4Ak1Lx0LoGQtEj16vWikmVbk59Nd1HS7XXSJKXPOBhNUnG19HjM2M8DN66qN79XS2E7twFwK2KCMOr9PgTC3psqoRywtnsCjrQbWTCX8Lr9oCT8GhNYGJw3EteeEqL59z6ITBPPHFvJr8VxrK3YMQiEuUI4HvKSSTgcHMQu9VV4RlTrRX6JQqSVGaKqxAZmlGPam92isnZNxRGP0nVdFWdnVKfRMHZvbyKuhMAK9EOUmD5f3uW07z3jW04z1a0db94gJ9d8ELNomAZJjcQ4FN8Fb67eyrxNEXmjKsWq7yvY6INCxf8ealwFAKr2kaAPgQUyt4xYpPgfPE3zAZGuXJyv2T5hXglhZajWv9zAlpFtLbzjSJh0a4qSHlEVasfVqaSiNyCdxU13yuhvYbaPYNt5Le0
lea edi, [ebp - 0x15dc]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x15dc]
push eax
lea ecx, [ebp - 0x28d4]
movsw word es:[edi], word [esi]
call fcn.00405820
lea eax, [ebp - 0x28d4]
mov byte [ebp - 4], 0x14
push eax
lea ecx, [ebp - 0x2e28]
call fcn.00407e30
lea ecx, [ebp - 0x28d4]
mov byte [ebp - 4], 0x13
call fcn.00405970
call fcn.00402160
mov edi, dword [ebp - 0x2d28]
test edi, edi
je 0x4414c1
push 0x588c30
lea ecx, [ebp - 0x2904]
call fcn.004024f0
push str.InstallRunFinish
lea ecx, [ebp - 0x28ec]
mov byte [ebp - 4], 0x15
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2904]
push ecx
lea ecx, [ebp - 0x28ec]
mov byte [ebp - 4], 0x16
push ecx
mov eax, dword [eax + 8]
mov ecx, ebx
call eax
lea ecx, [ebp - 0x28ec]
call fcn.004024b0
lea ecx, [ebp - 0x2904]
mov byte [ebp - 4], 0x13
call fcn.004024b0
push str.PushKeyName
lea ecx, [ebp - 0x291c]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x291c]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x17
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x291c]
mov dword [ebp - 0x2d40], eax
call fcn.004024b0
mov dword [ebp - 0x2e34], 0
mov dword [ebp - 0x2e30], 0
mov dword [ebp - 0x2e2c], 0
mov ecx, 0x58
mov byte [ebp - 4], 0x18
mov esi, str.glr5CUUp7xEfV5tf5bzVbXfXcUqtM42TH5H0KMx14HR76jWiFqcmOtarAD3bjTYtsp9nZanhrZ5Ptlyvjt1o8NF6jbWauTkMyKhxGp8CwMcLCnr2nVVwbKnkf9nR3zUlLVZZCUomE3gfV2IFc1N666YMVFCBGFcbqs2r7l0Xfk34fF7lOwTSPBmT8VjZMctYeOeKoJEMTeYz6qOQZ0dSQtfi68drD2ZZpo4XbqYgjK3bQAfCDSY4N6BMxuS2rOzoBugr6Ql6qLzgsHA8alaiIpTdWJ3Vf24fdBBDmbrhkGWhZvPsZFnivApeV4gcdbZKbYax5TgfcPJzT03i4qtGjrxw6giPJOuFR
lea edi, [ebp - 0xbec]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xbec]
push eax
lea ecx, [ebp - 0x2934]
movsw word es:[edi], word [esi]
call fcn.00405820
lea eax, [ebp - 0x2934]
mov byte [ebp - 4], 0x19
push eax
lea ecx, [ebp - 0x2e34]
call fcn.00407e30
lea ecx, [ebp - 0x2934]
mov byte [ebp - 4], 0x18
call fcn.00405970
push str.InstallPushUrl
lea ecx, [ebp - 0x294c]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x294c]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1a
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x294c]
mov dword [ebp - 0x2d48], eax
mov byte [ebp - 4], 0x18
call fcn.004024b0
push str.InstallBackPushUrl
lea ecx, [ebp - 0x279c]
call fcn.004024f0
mov eax, dword [ebx]
mov byte [ebp - 4], 0x1b
mov eax, dword [eax + 0x1c]
lea ecx, [ebp - 0x279c]
push ecx
mov ecx, ebx
call eax
lea ecx, [ebp - 0x279c]
mov byte [ebp - 4], 0x18
call fcn.004024b0
push str.InstallPush32Url
lea ecx, [ebp - 0x297c]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x297c]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1c
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x297c]
mov dword [ebp - 0x2d7c], eax
mov byte [ebp - 4], 0x18
call fcn.004024b0
push str.InstallPush64Url
lea ecx, [ebp - 0x2994]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2994]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1d
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x2994]
mov dword [ebp - 0x2d78], eax
call fcn.004024b0
mov dword [ebp - 0x2df8], 0
mov dword [ebp - 0x2df4], 0
mov dword [ebp - 0x2df0], 0
mov ecx, 0x43
mov byte [ebp - 4], 0x1e
mov esi, str.NZLBRF8wjn9yDRpXOx49Y0EzMiYMV8gjpOqz8z0TRRJe9AhoTSgPnm9myQjUXKMkl7wJSVcnhKk8jvdOkFauQcqTGNL5edPlNiGct2bjAS9H2impMmq6Nm6BGrCuAXVidfvpco2FDXqYGEPlBvt9Y7UJPa5l4t3NOCoEA99zjCL7fvpQEU6x0L7Pm7rt54YO1tJvVJVC8HZKq9mlGq1Y34Qv4evNgHLegnbVMUF13eDCevDUKfltCfDKp32jcF6Fg35OrWDqXBzs
lea edi, [ebp - 0x700]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x700]
push eax
lea ecx, [ebp - 0x29ac]
movsb byte es:[edi], byte [esi]
call fcn.00405820
lea eax, [ebp - 0x29ac]
mov byte [ebp - 4], 0x1f
push eax
lea ecx, [ebp - 0x2df8]
call fcn.00407e30
lea ecx, [ebp - 0x29ac]
mov byte [ebp - 4], 0x1e
call fcn.00405970
push str.InstallProgramName
lea ecx, [ebp - 0x29c4]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x29c4]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x20
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x29c4]
mov dword [ebp - 0x2d54], eax
mov byte [ebp - 4], 0x1e
call fcn.004024b0
push str.InstallAppDataName
lea ecx, [ebp - 0x29dc]
call fcn.004024f0
mov eax, dword [ebx]
mov byte [ebp - 4], 0x21
mov eax, dword [eax + 0x1c]
lea ecx, [ebp - 0x29dc]
push ecx
mov ecx, ebx
call eax
lea ecx, [ebp - 0x29dc]
mov dword [ebp - 0x2d58], eax
mov byte [ebp - 4], 0x1e
call fcn.004024b0
push str.InstallGreenBag
lea ecx, [ebp - 0x29f4]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x29f4]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x22
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x29f4]
mov dword [ebp - 0x2d80], eax
mov byte [ebp - 4], 0x1e
call fcn.004024b0
push str.InstallRunParam
lea ecx, [ebp - 0x2a0c]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2a0c]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x23
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x2a0c]
mov dword [ebp - 0x2db0], eax
mov byte [ebp - 4], 0x1e
call fcn.004024b0
push str.InstallFileName
lea ecx, [ebp - 0x2a24]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2a24]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x24
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x2a24]
mov dword [ebp - 0x2d50], eax
mov byte [ebp - 4], 0x1e
call fcn.004024b0
push str.InstallTempName
lea ecx, [ebp - 0x2a3c]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2a3c]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x25
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x2a3c]
mov dword [ebp - 0x2d5c], eax
mov byte [ebp - 4], 0x1e
call fcn.004024b0
call fcn.0047397f
push str.InstallCreateProcess
lea ecx, [ebp - 0x2a54]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2a54]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x26
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x2a54]
mov dword [ebp - 0x2da0], eax
mov byte [ebp - 4], 0x1e
call fcn.004024b0
push str.InstallWay
lea ecx, [ebp - 0x2a6c]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2a6c]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x27
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x2a6c]
mov dword [ebp - 0x2d74], eax
mov byte [ebp - 4], 0x1e
call fcn.004024b0
push str.InstallRandName
lea ecx, [ebp - 0x2a84]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2a84]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x28
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x2a84]
mov dword [ebp - 0x2da8], eax
mov byte [ebp - 4], 0x1e
call fcn.004024b0
call fcn.00402160
push str.InstallMDDesktopBrowser
lea ecx, [ebp - 0x2a9c]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2a9c]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x29
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x2a9c]
mov byte [ebp - 4], 0x1e
call fcn.004024b0
push str.InstallLastSend
lea ecx, [ebp - 0x2ab4]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2ab4]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x2a
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x2ab4]
mov dword [ebp - 0x2d70], eax
mov byte [ebp - 4], 0x1e
call fcn.004024b0
push str.InstallDragName
lea ecx, [ebp - 0x2acc]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2acc]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x2b
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x2acc]
mov dword [ebp - 0x2d4c], eax
call fcn.004024b0
mov dword [ebp - 0x2dbc], 0
mov dword [ebp - 0x2db8], 0
mov dword [ebp - 0x2db4], 0
mov ecx, 0x43
mov byte [ebp - 4], 0x2c
mov esi, str.4XXB1WWZ2jgPq8sjOTFznN0JLLwkxo7pOrTrwpQhue2MGrMP6FRwsSmiJApwji6nKEFrl6Fh1iuLGtntH5yt1HuY1rRn0wBzu7dDWoYJYzaBZunJNDPcS3DWnG6QUX4m0Xqg5AhlUhJCTYXNqeo4HCvF8W1Kt0SKATrrOjKH5c8u8bZJLyqj8eo4aM03Thyu5LxpBvIsg9vkN9EXr24Y6YY5Kr3Le3jVnfLnvxwlENhW45PoGMKAdp6XvxQP1PaQC0foOcCioR5mD
lea edi, [ebp - 0x810]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x2ae4]
movsw word es:[edi], word [esi]
call fcn.00405820
lea eax, [ebp - 0x2ae4]
mov byte [ebp - 4], 0x2d
push eax
lea ecx, [ebp - 0x2dbc]
call fcn.00407e30
lea ecx, [ebp - 0x2ae4]
mov byte [ebp - 4], 0x2c
call fcn.00405970
push str.InstallSwapRefer
lea ecx, [ebp - 0x2afc]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2afc]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x2e
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x2afc]
mov dword [ebp - 0x2d84], eax
mov byte [ebp - 4], 0x2c
call fcn.004024b0
push str.SwapReferOffsetIndex
lea ecx, [ebp - 0x2b14]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2b14]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x2f
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x2b14]
mov dword [ebp - 0x2d60], eax
mov byte [ebp - 4], 0x2c
call fcn.004024b0
cmp dword [ebp - 0x2d50], 0
jne 0x43fca2
push str.InstallRunExe
lea ecx, [ebp - 0x2b2c]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2b2c]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x30
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x2b2c]
mov dword [ebp - 0x2d50], eax
call fcn.004024b0
mov dword [ebp - 0x2dc8], 0
mov dword [ebp - 0x2dc4], 0
mov dword [ebp - 0x2dc0], 0
mov ecx, 0x7c
mov byte [ebp - 4], 0x31
mov esi, str.1gOYi96349iHN9LnGhGuhojjdlkRYySgPXZC0GOCEfxQ6j1UzXwJ6wBKPkbzr1lkENf8kJMZIsZ4LbZBafpvGpwHtF8Ygw9Khud2FnuIW0ylLFIqMJdRSecHs1XBqSreJEGGhICZtN0tjEP33Dfkfvm3UMw7SgwqhBUiGWoDIzUHhEzWYa4UyCRCkmrjIg63FdUfbJy2THA1YjQoslbktUIaXbHJ9moieOljjwTIpYP9hbygOkmHePGXatHRUpGaxlsggVKjwIRrEauLKKq53yPG82Q7YgIvXyeATANFKFhjYFnTrYQ6kimPXjtyot4whF1dn6EDtHmtwKOP026dORomSOKOqAdt7pagr7Z9RaUux3dEgtgUzk9RE90mZZYWuUOHBrH6O4QHsX6w8woHLVCeX7UDqZoW9GdJW81aDQxfLqcKY8GdaIAoRqCUS5UFaOU41KptTGOiHeXvqKAKL9m7UAJ1K7VX4MwZ4ssNm2kTyPZ
lea edi, [ebp - 0x1224]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1224]
push eax
lea ecx, [ebp - 0x2b44]
call fcn.00405820
lea eax, [ebp - 0x2b44]
mov byte [ebp - 4], 0x32
push eax
lea ecx, [ebp - 0x2dc8]
call fcn.00407e30
lea ecx, [ebp - 0x2b44]
call fcn.00405970
xor eax, eax
mov dword [ebp - 0x2d34], eax
mov dword [ebp - 0x2dd4], eax
mov dword [ebp - 0x2dd0], eax
mov dword [ebp - 0x2dcc], eax
mov ecx, 0x77
mov byte [ebp - 4], 0x33
mov esi, str.wdxGdH8MGFRDCRu71B9IcWZNSq4aVyQomajrpcQYaPLicvluqD6ouc9FcfQ0wJP2pNZMFGrxvibCk2GTXQCJbTCepmh9rCQEr7zeHsfFzYHKuysHGvZs9jXTGkaYQHoJabIoeMAxrUQY4yREbjqr0ZF1nnoB1ixSwvANXudC3pETLpOjmO2RMFYkqe9Tv4HmIzvKwKQyVuNIl1WViy6pynlB2qpv3ZUl8PetHqnypEe1UCrFVeJ7HZLJ4mvipeiGOxlSvmzsuVYXe9dn7rdO7Lm889HLVX8400uY6D0nvIsxpID47GDJXu1ogNbgoC0J81f3YUDNno5DSjVVhFI5vWPZQxyA41AfxhoIebLAbFoml8nF3XQTCplkyKD4HS4GOKxfo1PrPiJP6DuDmYubUchuopeCTkAsPJdKClLpicpnwOgZVsPOZVXT1XoTtVZjBt1o20L9LsZ39oxeIMz5Nc3cGKJkn
lea edi, [ebp - 0x1404]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1404]
push eax
lea ecx, [ebp - 0x2b5c]
movsw word es:[edi], word [esi]
call fcn.00405820
lea eax, [ebp - 0x2b5c]
mov byte [ebp - 4], 0x34
push eax
lea ecx, [ebp - 0x2dd4]
call fcn.00407e30
lea ecx, [ebp - 0x2b5c]
call fcn.00405970
mov dword [ebp - 0x2d38], 0
mov dword [ebp - 0x2d3c], 0
mov dword [ebp - 0x2de0], 0
mov dword [ebp - 0x2ddc], 0
mov dword [ebp - 0x2dd8], 0
mov ecx, 0x45
mov byte [ebp - 4], 0x35
mov esi, str.ZMQgDCqZb28m4mXAc9JdgkzMHcL9FByAiMpE66JIWRwtr279k7A3nF2XTxYYVACRwzesfck9ONF4Gvq1nbhG1tVIs3YbupaiC8ectzwGWVhllpzu3BDzmzqMaX3nPRun31GSwNPsH1gVMlRfnr7cDnzOR1rKysprMNmi4x97JxLy4YemzC4mNPuXmVgYZafcJ8XTE8iY57mzhpd7jj7PjrWg3dMYIQ4ANmQNXR4v6t0GQagWBvaW8PIxxrCQim43tjh6mgovldoRekwxqmRScx
lea edi, [ebp - 0x4e4]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x4e4]
push eax
lea ecx, [ebp - 0x2b74]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00405820
lea eax, [ebp - 0x2b74]
mov byte [ebp - 4], 0x36
push eax
lea ecx, [ebp - 0x2de0]
call fcn.00407e30
lea ecx, [ebp - 0x2b74]
mov byte [ebp - 4], 0x35
call fcn.00405970
push 0x63d8a0
lea ecx, [ebp - 0x243c]
call fcn.004024f0
push 0x63d8a0
lea ecx, [ebp - 0x23f4]
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x2d28], 0
call fcn.004024f0
mov edi, dword [ebp - 0x2d74]
mov byte [ebp - 4], 0x38
test edi, edi
je 0x43ffcc
mov esi, dword [edi + 0x14]
cmp esi, 8
jb 0x43fe3c
mov eax, dword [edi]
jmp 0x43fe3e
mov eax, edi
mov ecx, str.GreenBag
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43fe69
test dx, dx
je 0x43fe65
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43fe69
add eax, 4
add ecx, 4
test dx, dx
jne 0x43fe43
xor eax, eax
jmp 0x43fe6e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43fef3
mov dword [ebp - 0x2e40], eax
mov dword [ebp - 0x2e3c], eax
mov dword [ebp - 0x2e38], eax
mov ecx, 0x42
mov byte [ebp - 4], 0x39
mov esi, str.3pqPVPyOrVJd7pCL84lfg1dTgRRpx7jTubx3NgNlWbkZa3Pk9yb5kiBgmulfN8IxyjYPDnLfKiEzT1lHAJoPKmvcQGveeGL1afjPAvYIDBtXeCApPnOE5PyidHLZU02Yvt2E9MGoncBBsx2C4ETN7xeCAQgEoilYAwKu1blciJJapQ73xNttigNalosFZu6b8bSvUhRQjLCX9ek1ByrQSH0SEctWbnoU1rIC8rYAEnR6ZUd1g3ymxWZYtdgeItJuHnr8MeI4gq
lea edi, [ebp - 0x5f0]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x5f0]
push eax
lea ecx, [ebp - 0x2b8c]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00405820
lea eax, [ebp - 0x2b8c]
mov byte [ebp - 4], 0x3a
push eax
lea ecx, [ebp - 0x2e40]
call fcn.00407e30
lea ecx, [ebp - 0x2b8c]
call fcn.00405970
mov esi, 1
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x2e40]
mov dword [ebp - 0x2d34], esi
call fcn.004059b0
jmp 0x43ffce
cmp esi, 8
jb 0x43fefc
mov eax, dword [edi]
jmp 0x43fefe
mov eax, edi
mov ecx, str.DestopShort
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43ff29
test dx, dx
je 0x43ff25
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43ff29
add eax, 4
add ecx, 4
test dx, dx
jne 0x43ff03
xor eax, eax
jmp 0x43ff2e
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43ff46
call fcn.00402160
mov dword [ebp - 0x2d38], 1
jmp 0x43ffcc
cmp esi, 8
jb 0x43ff4f
mov eax, dword [edi]
jmp 0x43ff51
mov eax, edi
mov ecx, str.RunMemDll
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43ff7c
test dx, dx
je 0x43ff78
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43ff7c
add eax, 4
add ecx, 4
test dx, dx
jne 0x43ff56
xor eax, eax
jmp 0x43ff81
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43ff8c
call fcn.00402160
jmp 0x43ffcc
mov ecx, edi
mov esi, 0x588ebc
call fcn.00402580
mov cx, word [eax]
cmp cx, word [esi]
jne 0x43ffbe
test cx, cx
je 0x43ffba
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x43ffbe
add eax, 4
add esi, 4
test cx, cx
jne 0x43ff98
xor eax, eax
jmp 0x43ffc3
sbb eax, eax
or eax, 1
test eax, eax
jne 0x43ffcc
call fcn.0046d884
xor esi, esi
lea ecx, [ebp - 0x2e64]
call fcn.004c035c
lea ecx, [ebp - 0x2e64]
mov byte [ebp - 4], 0x3b
call fcn.004c054c
test eax, eax
je 0x43fff8
mov eax, dword [ebp - 0x2d78]
test eax, eax
je 0x44000f
jmp 0x440009
mov ecx, dword [ebp - 0x2d7c]
test ecx, ecx
mov eax, dword [ebp - 0x2d48]
cmovne eax, ecx
mov dword [ebp - 0x2d48], eax
call fcn.00402160
mov eax, dword [ebp - 0x2d80]
test eax, eax
je 0x44006b
cmp dword [eax + 0x14], 8
jb 0x440026
mov eax, dword [eax]
mov ecx, 0x588c30
nop dword [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x440056
test dx, dx
je 0x440052
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x440056
add eax, 4
add ecx, 4
test dx, dx
jne 0x440030
xor eax, eax
jmp 0x44005b
sbb eax, eax
or eax, 1
test eax, eax
mov eax, 1
cmove esi, eax
mov dword [ebp - 0x2d34], esi
mov dword [ebp - 0x2dec], 0
mov dword [ebp - 0x2de8], 0
mov dword [ebp - 0x2de4], 0
mov ecx, 0x6d
mov byte [ebp - 4], 0x3c
mov esi, str.eCPfeP3ZBDIMPJr1JMkCLT5RTyO0t1bZc1P6Z7llFWDOs3IzJVp4oKbAbeKUWJls9ThJqBfEXVTUKDwqT9Cp3uXyrCun8uLchpRXiIVA63STtMB48CPg08PJnmHZ1ZQ4P04VxsJyUbLIii9Q8ZprPvSr7JB57uKR1T4vqeHTkKLHyMNnrHIvZb23TG8q2MsNhD1cHhgSUUiPGbJWBHu5Qffo4iGRIIihNEFjpk5DMrUa8T9hseILGerpwBnl33c47lInrF7Ws4IQ37frbMMaxb8MUaIOMiFEopjcehWrzJYNR82TzKwF9lRe4Oyt3ar9EWgyz9xlZzIx88MUTrUO7coW3N8hSNatUyipx9KKnlo60Gvtty8kjtxBz8oQ2ysHAV5GTdLA8QVfwgcwivkoyTNvashiTDBGx6o4Ia38IcrVzobaqApD6
lea edi, [ebp - 0x1794]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1794]
push eax
lea ecx, [ebp - 0x2ba4]
movsw word es:[edi], word [esi]
call fcn.00405820
lea eax, [ebp - 0x2ba4]
mov byte [ebp - 4], 0x3d
push eax
lea ecx, [ebp - 0x2dec]
call fcn.00407e30
lea ecx, [ebp - 0x2ba4]
mov byte [ebp - 4], 0x3c
call fcn.00405970
mov eax, dword [ebp - 0x2da0]
test eax, eax
je 0x440141
cmp dword [eax + 0x14], 8
jb 0x4400ea
mov eax, dword [eax]
mov ecx, 0x588c30
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x440128
test dx, dx
je 0x440112
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x440128
add eax, 4
add ecx, 4
test dx, dx
jne 0x4400f0
xor eax, eax
xor ecx, ecx
test eax, eax
mov edi, 1
cmove ecx, edi
mov dword [ebp - 0x2d3c], ecx
jmp 0x440146
sbb eax, eax
mov edi, 1
or eax, 1
xor ecx, ecx
test eax, eax
cmove ecx, edi
mov dword [ebp - 0x2d3c], ecx
jmp 0x440146
mov edi, 1
mov ecx, dword [ebp - 0x2d70]
test ecx, ecx
je 0x4401a7
cmp dword [ecx + 0x14], 8
jb 0x440158
mov ecx, dword [ecx]
mov eax, 0x588c30
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x440193
test dx, dx
je 0x440182
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x440193
add ecx, 4
add eax, 4
test dx, dx
jne 0x440160
xor eax, eax
xor esi, esi
test eax, eax
cmove esi, edi
mov dword [ebp - 0x2d44], esi
jmp 0x4401a9
sbb eax, eax
xor esi, esi
or eax, 1
test eax, eax
cmove esi, edi
mov dword [ebp - 0x2d44], esi
jmp 0x4401a9
xor esi, esi
mov eax, dword [ebp - 0x2d40]
test eax, eax
je 0x440205
cmp dword [eax + 0x14], 8
jb 0x4401bb
mov eax, dword [eax]
mov ecx, str.greenbaggame
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4401f2
test dx, dx
je 0x4401e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4401f2
add eax, 4
add ecx, 4
test dx, dx
jne 0x4401c0
xor eax, eax
xor edi, edi
test eax, eax
mov eax, 1
cmove edi, eax
jmp 0x440207
sbb eax, eax
xor edi, edi
or eax, 1
test eax, eax
mov eax, 1
cmove edi, eax
jmp 0x440207
xor edi, edi
call fcn.0046db77
mov eax, dword [ebp - 0x2d84]
test eax, eax
je 0x44022a
cmp dword [eax + 0x14], 8
jb 0x44021e
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x243c]
call fcn.00402600
call fcn.00473802
mov eax, dword [ebp - 0x2d60]
test eax, eax
je 0x440250
cmp dword [eax + 0x14], 8
jb 0x440241
mov eax, dword [eax]
push eax
call fcn.004e71c9
add esp, 4
mov dword [ebp - 0x2d28], eax
test esi, esi
je 0x440261
mov ecx, dword [ebp - 0x2d30]
mov dword [ecx + 0x34], 1
call fcn.00470b80
mov eax, dword [ebp - 0x2d48]
test eax, eax
je 0x441447
cmp dword [eax + 0x14], 8
jb 0x44027c
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x24b4]
call fcn.004024f0
cmp dword [ebp - 0x24a0], 8
lea eax, [ebp - 0x24b4]
mov byte [ebp - 4], 0x3e
cmovae eax, dword [ebp - 0x24b4]
push eax
lea eax, [ebp - 0x2424]
push eax
call fcn.004cff6b
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x3f
push 0xffffffffffffffff
push eax
mov word [ebp - 0x23dc], ax
lea ecx, [ebp - 0x23dc]
lea eax, [ebp - 0x237c]
mov dword [ebp - 0x23c8], 7
push eax
mov dword [ebp - 0x23cc], 0
call fcn.004028b0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x2424]
mov byte [ebp - 4], 0x40
push eax
lea ecx, [ebp - 0x23dc]
call fcn.004043c0
push 0x63d8a0
lea ecx, [ebp - 0x2454]
call fcn.004024f0
mov esi, dword [ebp - 0x2db0]
mov byte [ebp - 4], 0x41
test esi, esi
je 0x4403aa
call fcn.0047106b
cmp dword [esi + 0x14], 8
jb 0x44032f
mov esi, dword [esi]
push esi
lea ecx, [ebp - 0x23f4]
call fcn.00402600
cmp dword [ebp - 0x2488], 8
lea eax, [ebp - 0x249c]
lea ecx, [ebp - 0x2bd4]
cmovae eax, dword [ebp - 0x249c]
push eax
call fcn.004024f0
push 0x5a97e8
lea ecx, [ebp - 0x2bbc]
mov byte [ebp - 4], 0x42
call fcn.004024f0
lea eax, [ebp - 0x2bd4]
mov byte [ebp - 4], 0x43
push eax
lea eax, [ebp - 0x2bbc]
push eax
lea eax, [ebp - 0x23f4]
push eax
call fcn.004cd062
add esp, 0xc
lea ecx, [ebp - 0x2bbc]
call fcn.004024b0
lea ecx, [ebp - 0x2bd4]
mov byte [ebp - 4], 0x41
call fcn.004024b0
mov esi, dword [ebp - 0x2d50]
test esi, esi
je 0x4403da
cmp dword [esi + 0x14], 8
jb 0x4403ca
mov eax, dword [esi]
lea ecx, [ebp - 0x2454]
push eax
call fcn.00402600
jmp 0x4403f0
mov eax, esi
lea ecx, [ebp - 0x2454]
push eax
call fcn.00402600
jmp 0x4403f0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x2424]
push eax
lea ecx, [ebp - 0x2454]
call fcn.004028b0
call fcn.00470691
cmp dword [ebp - 0x2470], 8
lea eax, [ebp - 0x2484]
lea ecx, [ebp - 0x2c04]
cmovae eax, dword [ebp - 0x2484]
push eax
call fcn.004024f0
push 0x5a97f8
lea ecx, [ebp - 0x2bec]
mov byte [ebp - 4], 0x44
call fcn.004024f0
lea eax, [ebp - 0x2c04]
mov byte [ebp - 4], 0x45
push eax
lea eax, [ebp - 0x2bec]
push eax
lea eax, [ebp - 0x2454]
push eax
call fcn.004cd062
add esp, 0xc
lea ecx, [ebp - 0x2bec]
call fcn.004024b0
lea ecx, [ebp - 0x2c04]
mov byte [ebp - 4], 0x41
call fcn.004024b0
mov eax, dword [ebp - 0x2d34]
test eax, eax
je 0x4408f9
push 0x63d8a0
lea ecx, [ebp - 0x2364]
call fcn.004024f0
cmp dword [ebp - 0x2d54], 0
mov byte [ebp - 4], 0x46
je 0x4404e1
call fcn.0047397f
lea eax, [ebp - 0x2cac]
push eax
call fcn.004d40ab
add esp, 4
lea ecx, [ebp - 0x2364]
push eax
call fcn.00404010
lea ecx, [ebp - 0x2cac]
call fcn.004024b0
push 0x63d88c
lea ecx, [ebp - 0x2364]
call fcn.00403fa0
mov eax, dword [ebp - 0x2d54]
cmp dword [eax + 0x14], 8
jb 0x440567
mov eax, dword [eax]
jmp 0x440567
cmp dword [ebp - 0x2d58], 0
je 0x44052d
call fcn.00402160
lea eax, [ebp - 0x2c7c]
push eax
call fcn.004d4045
add esp, 4
lea ecx, [ebp - 0x2364]
push eax
call fcn.00404010
lea ecx, [ebp - 0x2c7c]
call fcn.004024b0
push 0x63d88c
lea ecx, [ebp - 0x2364]
call fcn.00403fa0
mov ecx, dword [ebp - 0x2d58]
jmp 0x440562
cmp dword [ebp - 0x2d5c], 0
je 0x440585
lea eax, [ebp - 0x2cc4]
push eax
call fcn.004d4111
add esp, 4
lea ecx, [ebp - 0x2364]
push eax
call fcn.00404010
lea ecx, [ebp - 0x2cc4]
call fcn.004024b0
mov ecx, dword [ebp - 0x2d5c]
call fcn.00402580
push eax
lea ecx, [ebp - 0x2364]
call fcn.00403fa0
push 0x63d88c
lea ecx, [ebp - 0x2364]
call fcn.00403fa0
jmp 0x44059d
call fcn.00408f30
mov ecx, eax
call fcn.00405ed0
push eax
lea ecx, [ebp - 0x2364]
call fcn.00402600
call fcn.004739fe
lea eax, [ebp - 0x2364]
push eax
lea ecx, [ebp - 0x2cf4]
call fcn.004040b0
cmp dword [ebp - 0x2368], 8
lea eax, [ebp - 0x237c]
lea ecx, [ebp - 0x23ac]
mov byte [ebp - 4], 0x47
cmovae eax, dword [ebp - 0x237c]
push eax
call fcn.004024f0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x2424]
mov byte [ebp - 4], 0x48
push eax
lea ecx, [ebp - 0x23ac]
call fcn.004043c0
cmp dword [ebp - 0x2398], 8
lea eax, [ebp - 0x23ac]
cmovae eax, dword [ebp - 0x23ac]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x44066a
push 0x5a97fc
lea ecx, [ebp - 0x2c34]
call fcn.004024f0
push str.PushErrCode
lea ecx, [ebp - 0x2c1c]
mov byte [ebp - 4], 0x49
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2c34]
push ecx
lea ecx, [ebp - 0x2c1c]
mov byte [ebp - 4], 0x4a
push ecx
mov eax, dword [eax + 8]
mov ecx, ebx
call eax
lea ecx, [ebp - 0x2c1c]
call fcn.004024b0
lea ecx, [ebp - 0x2c34]
mov byte [ebp - 4], 0x48
call fcn.004024b0
call fcn.0046df6c
lea eax, [ebp - 0x23ac]
push eax
lea eax, [ebp - 0x2cdc]
push eax
call fcn.004cd4ec
add esp, 8
mov ecx, eax
cmp dword [ecx + 0x14], 0x10
mov byte [ebp - 4], 0x4b
jb 0x440693
mov ecx, dword [ecx]
cmp dword [ebp - 0x2350], 8
lea eax, [ebp - 0x2364]
push 0
cmovae eax, dword [ebp - 0x2364]
push 0
push ecx
push eax
call fcn.0040a800
add esp, 0x10
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x2cdc]
call fcn.00405970
cmp dword [ebp - 0x2398], 8
lea eax, [ebp - 0x23ac]
cmovae eax, dword [ebp - 0x23ac]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test edi, edi
je 0x4407f8
lea ecx, [ebp - 0x2d29]
call fcn.0046b130
lea eax, [ebx + 0x18]
mov byte [ebp - 4], 0x4c
push eax
lea eax, [ebp - 0x25a4]
push eax
lea ecx, [ebp - 0x2d29]
call fcn.0042ba00
lea eax, [ebp - 0x25a4]
mov byte [ebp - 4], 0x4d
push 0x63d8a0
push eax
call fcn.00435820
add esp, 8
test al, al
je 0x440788
lea ecx, [ebp - 0x25a4]
call fcn.00402580
push eax
lea ecx, [ebp - 0x25bc]
call fcn.004024f0
push str.PushErrCode
lea ecx, [ebp - 0x2c4c]
mov byte [ebp - 4], 0x4e
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x25bc]
push ecx
lea ecx, [ebp - 0x2c4c]
mov byte [ebp - 4], 0x4f
push ecx
mov eax, dword [eax + 8]
mov ecx, ebx
call eax
lea ecx, [ebp - 0x2c4c]
call fcn.004024b0
lea ecx, [ebp - 0x25bc]
mov byte [ebp - 4], 0x4d
call fcn.004024b0
push 0x588c30
lea ecx, [ebp - 0x25ec]
call fcn.004024f0
push str.WriteShutCutNameToReg
lea ecx, [ebp - 0x25d4]
mov byte [ebp - 4], 0x50
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x25ec]
push ecx
lea ecx, [ebp - 0x25d4]
mov byte [ebp - 4], 0x51
push ecx
mov eax, dword [eax + 8]
mov ecx, ebx
call eax
lea ecx, [ebp - 0x25d4]
call fcn.004024b0
lea ecx, [ebp - 0x25ec]
call fcn.004024b0
lea ecx, [ebp - 0x25a4]
call fcn.004024b0
lea ecx, [ebp - 0x2d29]
call fcn.00402160
jmp 0x4408d8
call fcn.0047029a
test esi, esi
je 0x4408d8
push 0x63d8a0
lea ecx, [ebp - 0x24e4]
call fcn.004024f0
lea eax, [ebp - 0x2364]
mov byte [ebp - 4], 0x52
push eax
lea ecx, [ebp - 0x24e4]
call fcn.00403ff0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x2454]
push eax
lea ecx, [ebp - 0x24e4]
call fcn.004043c0
lea ecx, [ebp - 0x2d9c]
call fcn.00436450
mov ecx, 0x36
mov byte [ebp - 4], 0x53
mov esi, str.KlNNPpGf7dX3Mkcfz1AsbNdc8xXSIJg3YwRLpzwKbtYn7zt8lZJPP2iTt4ExSMcWMmY9sUE6CFqCLwoUBfsIo2BWwus3XeWqxa6tyZ5bqAigd0UlOpGAeJZCPIB2BLQnUqqANo0uPurBstXWrmAVTV4xr5mWFftK6FTvegWp7XEhHPi0biNplMZ2sWPZTHYgJ4KDvkpG2CawCOQNPxNd4VDGz
lea edi, [ebp - 0xec]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xec]
push eax
lea ecx, [ebp - 0x2604]
movsw word es:[edi], word [esi]
call fcn.00405820
lea eax, [ebp - 0x2604]
mov byte [ebp - 4], 0x54
push eax
lea ecx, [ebp - 0x2d9c]
call fcn.00407e30
lea ecx, [ebp - 0x2604]
mov byte [ebp - 4], 0x53
call fcn.00405970
push 0x493e0
push 1
lea ecx, [ebp - 0x23f4]
call fcn.00402580
push eax
lea ecx, [ebp - 0x24e4]
call fcn.00402580
push eax
call fcn.004c12de
add esp, 0x10
lea ecx, [ebp - 0x2d9c]
call fcn.004059b0
lea ecx, [ebp - 0x24e4]
call fcn.004024b0
lea ecx, [ebp - 0x23ac]
call fcn.004024b0
lea ecx, [ebp - 0x2cf4]
call fcn.004024b0
lea ecx, [ebp - 0x2364]
jmp 0x441410
cmp dword [ebp - 0x2d38], 0
lea eax, [ebp - 0x237c]
push eax
je 0x440e9a
lea ecx, [ebp - 0x246c]
call fcn.004040b0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x2424]
mov byte [ebp - 4], 0x55
push eax
lea ecx, [ebp - 0x246c]
call fcn.004043c0
lea eax, [ebp - 0x2394]
push eax
call fcn.004d4045
add esp, 4
push str.Icon_
lea ecx, [ebp - 0x2394]
mov byte [ebp - 4], 0x56
call fcn.00403fa0
cmp dword [ebp - 0x2380], 8
lea eax, [ebp - 0x2394]
cmovae eax, dword [ebp - 0x2394]
push eax
call fcn.004c0987
add esp, 4
lea eax, [ebp - 0x2424]
lea ecx, [ebp - 0x2394]
push 0xffffffffffffffff
push 0
push eax
call fcn.004043c0
cmp dword [ebp - 0x2380], 8
lea ecx, [ebp - 0x2394]
lea eax, [ebp - 0x246c]
cmovae ecx, dword [ebp - 0x2394]
cmp dword [ebp - 0x2458], 8
push ecx
cmovae eax, dword [ebp - 0x246c]
push eax
call fcn.004ce807
add esp, 8
lea ecx, [ebp - 0x255c]
call fcn.00404090
xor edi, edi
mov byte [ebp - 4], 0x57
mov dword [ebp - 0x2d38], edi
call fcn.00402160
mov eax, dword [ebp - 0x2dac]
test eax, eax
je 0x4409f3
mov ecx, eax
call fcn.00402580
push eax
lea ecx, [ebp - 0x255c]
call fcn.00402600
push 0
push str.daohang
lea ecx, [ebp - 0x255c]
call fcn.00404d30
cmp eax, 0xffffffff
jle 0x440a5b
mov eax, dword [ebp - 0x2da8]
test eax, eax
je 0x440a5b
mov ecx, eax
mov esi, 0x588c30
call fcn.00402580
mov cx, word [eax]
cmp cx, word [esi]
jne 0x440a46
test cx, cx
je 0x440a42
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x440a46
add eax, 4
add esi, 4
test cx, cx
jne 0x440a20
xor eax, eax
jmp 0x440a4b
sbb eax, eax
or eax, 1
test eax, eax
mov eax, 1
cmove edi, eax
mov dword [ebp - 0x2d38], edi
lea ecx, [ebp - 0x2d6c]
call fcn.00436450
mov ecx, 0x46
mov byte [ebp - 4], 0x58
mov esi, str.qkpVnkk3KqMNdj7npjRcl8D7bUQVTnSjRGYs8nWvaj7HhLPy0ABtjRJTt2pP8txH7CtTT0Iz8Xzg33DYHp6sl2mRypbvNpthmT6vs04eueCkRafQNRft0iaoFXwNKSNKsdnOQ14SoOAO7s8nBbeAUerg9C2p6DdCAn7l9eSvi0BxSFUECi2XKer8owH0rLRqHGWtb2C3vGBYoVFJM9c5THKFgFpIXvy5xDzXiEZLNXogNinko0heYA9I7qvTWDBngnecKYFmeeeHqu7RbbyJneeKkh
lea edi, [ebp - 0x3cc]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x3cc]
push eax
lea ecx, [ebp - 0x261c]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00405820
lea eax, [ebp - 0x261c]
mov byte [ebp - 4], 0x59
push eax
lea ecx, [ebp - 0x2d6c]
call fcn.00407e30
lea ecx, [ebp - 0x261c]
mov byte [ebp - 4], 0x58
call fcn.00405970
push str.LinkUrl
lea ecx, [ebp - 0x2634]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2634]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x5a
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x2634]
mov byte [ebp - 4], 0x58
mov esi, eax
call fcn.004024b0
push str.HttpUrl
lea ecx, [ebp - 0x264c]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x264c]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x5b
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x264c]
mov byte [ebp - 4], 0x58
mov edi, eax
call fcn.004024b0
push str.IconLabel
lea ecx, [ebp - 0x2664]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2664]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x5c
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x2664]
mov dword [ebp - 0x2d34], eax
mov byte [ebp - 4], 0x58
call fcn.004024b0
call fcn.004741ea
lea ecx, [ebp - 0x2514]
call fcn.00404090
lea ecx, [ebp - 0x24cc]
call fcn.00404090
mov eax, dword [ebp - 0x2d34]
mov byte [ebp - 4], 0x5e
test eax, eax
je 0x440b95
mov ecx, eax
call fcn.00402580
push eax
lea ecx, [ebp - 0x24cc]
call fcn.00402600
call fcn.00402160
test esi, esi
je 0x440bb6
mov ecx, esi
call fcn.00402580
push eax
lea ecx, [ebp - 0x2514]
call fcn.00402600
call fcn.00402160
test edi, edi
je 0x440bcd
mov ecx, edi
call fcn.00402580
push eax
lea ecx, [ebp - 0x2514]
call fcn.00402600
call fcn.0046f639
cmp dword [ebp - 0x2d38], 0
je 0x440db5
test esi, esi
je 0x440d2a
mov ecx, esi
call fcn.00402580
push eax
lea ecx, [ebp - 0x2394]
call fcn.00402580
mov ecx, dword [ebp - 0x2d30]
push eax
lea eax, [ebp - 0x258c]
push eax
call fcn.00439f20
mov edi, dword [ebp - 0x2d4c]
test edi, edi
je 0x440d1a
lea ecx, [ebp - 0x2d90]
call fcn.00436450
mov ecx, 0x57
mov byte [ebp - 4], 0x60
mov esi, str.6SxPgfBdOcf07elCtKDAgwnt4YdDTTE0Y2ff2QUoxPBjduJsHeCn4YYnhbI855HxvzjnM0EcX3UfKccZW513j9iB5vsIbxEtNr86rEfW5qkCailh3Q9Hq1rSDIbbjLyvcO9BR6xf9TlMZuO5PzlbVGxANRU6i9Snc6PcgRSyLgB566fQ8aVNK7DEfFcuDpJaIf4YKgmIbTlKrE7devbmTSr3Ko7e7dNVk49cEPgHW8TTc1UiTZJKoHbuIfp2Rpml0isjkYkeTHDUDXkg3DjxzchDvjzZ68ghHpYQgRK7kYcMzGYOQI1Dw9thHK1I2Qydna1b0eph5a8y2H7LXZiGgmHZCJl
lea edi, [ebp - 0xd48]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xd48]
push eax
lea ecx, [ebp - 0x267c]
call fcn.00405820
lea eax, [ebp - 0x267c]
mov byte [ebp - 4], 0x61
push eax
lea ecx, [ebp - 0x2d90]
call fcn.00407e30
lea ecx, [ebp - 0x267c]
call fcn.00405970
cmp dword [ebp - 0x257c], 0
sete al
test al, al
jne 0x440d0f
lea ecx, [ebp - 0x2d9c]
call fcn.00436450
mov ecx, 0x57
mov byte [ebp - 4], 0x62
mov esi, str.1gXTNTnbwcWtj13slpaRA0ZQpGyhP1FWdwsv0ZuKqM6uMcnqZHDfCQOhyf2iKFBOSr7f87Oy6e8yFcNnzPZGIXYV7v7mctLkTUs67P26LZMbMIdK5ga0i1ueFzGoQhmtDWHmHOWeQHJWozgL1GBwpwbNW6KxfxF2LVLzfchnAAenw6ICC52mlmg8fclYTTY92hoXS30lyHMWJ0VoEYrwfbvXo4J39Zatkd3w7GxsnAL2eaXPKbfh5Y4XLwMt2G2VCj8MJ7ySDPzMPdkrqmz0HjYq2I0C6Yyh1Vfc0uTejqSpFXEIwNGZ5KxoXcLdcH6fJzL8BLrLqLHxxzNv3PZ2rvDDwIpMX
lea edi, [ebp - 0xea8]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xea8]
push eax
lea ecx, [ebp - 0x2694]
movsw word es:[edi], word [esi]
call fcn.00405820
lea eax, [ebp - 0x2694]
mov byte [ebp - 4], 0x63
push eax
lea ecx, [ebp - 0x2d9c]
call fcn.00407e30
lea ecx, [ebp - 0x2694]
mov byte [ebp - 4], 0x62
call fcn.00405970
push dword [ebp - 0x2d28]
lea ecx, [ebp - 0x243c]
call fcn.00402580
push eax
lea ecx, [ebp - 0x258c]
call fcn.00402580
mov ecx, dword [ebp - 0x2d30]
push eax
call fcn.00457640
lea ecx, [ebp - 0x2d9c]
call fcn.004059b0
lea ecx, [ebp - 0x2d90]
call fcn.004059b0
lea ecx, [ebp - 0x258c]
call fcn.004024b0
jmp 0x440e58
test edi, edi
je 0x440e58
call fcn.00402160
mov ecx, edi
call fcn.00402580
push eax
lea ecx, [ebp - 0x2394]
call fcn.00402580
mov esi, dword [ebp - 0x2d30]
mov ecx, esi
push eax
lea eax, [ebp - 0x2574]
push eax
call fcn.004393c0
mov edi, dword [ebp - 0x2d4c]
mov byte [ebp - 4], 0x64
test edi, edi
je 0x440da5
cmp dword [ebp - 0x2564], 0
sete al
test al, al
jne 0x440da5
call fcn.00402160
push dword [ebp - 0x2d28]
lea ecx, [ebp - 0x243c]
call fcn.00402580
push eax
lea ecx, [ebp - 0x2574]
call fcn.00402580
push eax
mov ecx, esi
call fcn.00457640
lea ecx, [ebp - 0x2574]
call fcn.004024b0
jmp 0x440e58
call fcn.0046dcf1
mov eax, dword [ebp - 0x2d34]
test esi, esi
je 0x440def
test eax, eax
je 0x440def
mov ecx, esi
call fcn.00402580
push eax
lea ecx, [ebp - 0x2394]
call fcn.00402580
push eax
lea ecx, [ebp - 0x24cc]
call fcn.00402580
push eax
call fcn.004d14e6
jmp 0x440e21
test edi, edi
je 0x440e24
test eax, eax
je 0x440e24
call fcn.00402160
mov ecx, edi
call fcn.00402580
push eax
lea ecx, [ebp - 0x2394]
call fcn.00402580
push eax
lea ecx, [ebp - 0x24cc]
call fcn.00402580
push eax
call fcn.004d1342
add esp, 0xc
mov edi, dword [ebp - 0x2d4c]
test edi, edi
je 0x440e58
call fcn.00402160
push dword [ebp - 0x2d28]
lea ecx, [ebp - 0x243c]
call fcn.00402580
push eax
mov ecx, edi
call fcn.00402580
mov ecx, dword [ebp - 0x2d30]
push eax
call fcn.00457640
lea ecx, [ebp - 0x24cc]
call fcn.004024b0
lea ecx, [ebp - 0x2514]
call fcn.004024b0
lea ecx, [ebp - 0x2d6c]
call fcn.004059b0
lea ecx, [ebp - 0x255c]
call fcn.004024b0
lea ecx, [ebp - 0x2394]
call fcn.004024b0
lea ecx, [ebp - 0x246c]
jmp 0x441410
lea ecx, [ebp - 0x23c4]
call fcn.004040b0
lea ecx, [ebp - 0x2d90]
call fcn.00436450
mov ecx, 0x4a
mov byte [ebp - 4], 0x66
mov esi, str.JuwoUEW0nlwCm7nL8hK2CwgcFCKQ2HUd50cL7gso8FdfwJidfC6uylI93SJGi44E4VN9BsYzPTxS9dVkbtIlfjG3w74uPUBx5ksNXvml6MpBKb5uCAc1upaix2yCxk77FS0z1VgzagGcMSA3ObqCs22uKoInoHQPxoFNZRCGgkKiV3o0bfWifp2dDlHClNGt1IOSWqGmLvGyVaY0YDyDRulvOeV8QH0Z2Bmy3Lb4WjLVaWWP7v3qAVRowqWMfikJ9sZ32317NXQtcSKOSu4lpCYn8uisnWswqldYeWU
lea edi, [ebp - 0x938]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x938]
push eax
lea ecx, [ebp - 0x2964]
call fcn.00405820
lea eax, [ebp - 0x2964]
mov byte [ebp - 4], 0x67
push eax
lea ecx, [ebp - 0x2d90]
call fcn.00407e30
lea ecx, [ebp - 0x2964]
mov byte [ebp - 4], 0x66
call fcn.00405970
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x2454]
push eax
lea ecx, [ebp - 0x23c4]
call fcn.004043c0
lea eax, [ebp - 0x23dc]
push eax
lea ecx, [ebp - 0x24fc]
call fcn.004040b0
lea eax, [ebp - 0x23c4]
mov byte [ebp - 4], 0x68
push eax
lea ecx, [ebp - 0x252c]
call fcn.004040b0
lea eax, [ebp - 0x24fc]
mov byte [ebp - 4], 0x69
push eax
call fcn.004cd323
lea eax, [ebp - 0x252c]
push eax
call fcn.004cd323
call fcn.0046d97f
lea eax, [ebp - 0x252c]
push eax
lea eax, [ebp - 0x24fc]
push eax
call fcn.004357c0
add esp, 0x10
test al, al
je 0x440fbc
lea ecx, [ebp - 0x23c4]
call fcn.00402580
push eax
lea ecx, [ebp - 0x23dc]
call fcn.00402580
push eax
call fcn.004ce807
add esp, 8
lea ecx, [ebp - 0x23dc]
call fcn.00402580
push eax
lea eax, [ebp - 0x2d0c]
push eax
call fcn.004cff6b
add esp, 8
lea ecx, [ebp - 0x2d0c]
call fcn.004024b0
call fcn.0046ff26
cmp dword [ebp - 0x2d3c], 0
je 0x4411ce
lea eax, [ebp - 0x26dc]
mov dword [ebp - 0x2d3c], 0
push eax
call fcn.00408f30
mov ecx, eax
call fcn.00411440
push 0x588e78
lea ecx, [ebp - 0x240c]
mov byte [ebp - 4], 0x6a
call fcn.004024f0
push str.___AppPath
lea ecx, [ebp - 0x240c]
mov byte [ebp - 4], 0x6b
call fcn.00403fa0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x23c4]
push eax
lea ecx, [ebp - 0x240c]
call fcn.004043c0
lea ecx, [ebp - 0x2d6c]
call fcn.00436450
mov ecx, 0x35
mov byte [ebp - 4], 0x6c
mov esi, str.NkZwSkB4k0O0KbkFMnacYtzuhCWb1e1FZJYGg5a5ayyGC8G8j0S2GeRMlmh79EvgIzlIP9jzqHmOLyCQ8b8feuwWvEWYK1qf9QIOak9LMxpGAPdxF76VibzZDOvphuEterquXHd5PXq8DIgckHF5q3YGSzWItDqOF7wG0ZoUf09if2ocxhBmIigy7yQTyp2bcMeozcisGjJ8iJiXzMW3B
lea edi, [ebp - 0x1c4]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1c4]
push eax
lea ecx, [ebp - 0x26ac]
movsw word es:[edi], word [esi]
call fcn.00405820
lea eax, [ebp - 0x26ac]
mov byte [ebp - 4], 0x6d
push eax
lea ecx, [ebp - 0x2d6c]
call fcn.00407e30
lea ecx, [ebp - 0x26ac]
mov byte [ebp - 4], 0x6c
call fcn.00405970
cmp dword [ebp - 0x23e4], 0
sete al
test al, al
jne 0x44116a
push str.___AppParam
lea ecx, [ebp - 0x240c]
call fcn.00403fa0
push 0xbb8
lea eax, [ebp - 0x234c]
push 0
push eax
call fcn.004e37a0
lea eax, [ebp - 0x23f4]
mov dword [ebp - 0x2da4], 0xbb8
push eax
lea eax, [ebp - 0x2544]
push eax
call fcn.004cd4ec
add esp, 0x14
lea eax, [ebp - 0x2da4]
mov byte [ebp - 4], 0x6e
push eax
lea eax, [ebp - 0x234c]
push eax
push dword [ebp - 0x2534]
lea ecx, [ebp - 0x2544]
call fcn.00459140
push eax
call fcn.004c820f
add esp, 0x10
call fcn.00472e15
lea eax, [ebp - 0x234c]
push eax
lea ecx, [ebp - 0x26c4]
call fcn.00405820
lea eax, [ebp - 0x26c4]
mov byte [ebp - 4], 0x6f
push eax
lea eax, [ebp - 0x2d24]
push eax
call fcn.004cd1cb
add esp, 8
push eax
lea ecx, [ebp - 0x240c]
mov byte [ebp - 4], 0x70
call fcn.00404640
lea ecx, [ebp - 0x2d24]
call fcn.004024b0
lea ecx, [ebp - 0x26c4]
call fcn.00405970
lea ecx, [ebp - 0x2544]
mov byte [ebp - 4], 0x6c
call fcn.00405970
push 0x493e0
push 1
lea ecx, [ebp - 0x240c]
call fcn.00402580
push eax
lea ecx, [ebp - 0x26dc]
call fcn.00402580
push eax
call fcn.004c12de
add esp, 0x10
mov edi, 1
test eax, eax
jne 0x4411a0
mov dword [ebp - 0x2d3c], edi
lea ecx, [ebp - 0x2d6c]
call fcn.004059b0
lea ecx, [ebp - 0x240c]
call fcn.004024b0
lea ecx, [ebp - 0x26dc]
mov byte [ebp - 4], 0x69
call fcn.004024b0
cmp dword [ebp - 0x2d3c], 0
je 0x4411f7
push 0x493e0
push 1
lea ecx, [ebp - 0x23f4]
call fcn.00402580
push eax
lea ecx, [ebp - 0x23c4]
call fcn.00402580
push eax
call fcn.004c12de
add esp, 0x10
mov edi, eax
mov eax, dword [ebp - 0x2d40]
test eax, eax
je 0x4412e2
mov ecx, eax
mov esi, str.iqiyi
call fcn.00402580
mov cx, word [eax]
cmp cx, word [esi]
jne 0x441237
test cx, cx
je 0x441233
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x441237
add eax, 4
add esi, 4
test cx, cx
jne 0x441211
xor eax, eax
jmp 0x44123c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4412e2
push str.InstallQyHelper
lea ecx, [ebp - 0x26f4]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x26f4]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x71
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x26f4]
mov dword [ebp - 0x2d40], eax
mov byte [ebp - 4], 0x69
call fcn.004024b0
push str.InstallQyHelperParam
lea ecx, [ebp - 0x270c]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x270c]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x72
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x270c]
mov byte [ebp - 4], 0x69
mov esi, eax
call fcn.004024b0
cmp dword [ebp - 0x2d40], 0
je 0x4412e2
test esi, esi
je 0x4412e2
mov ecx, esi
call fcn.00402580
mov ecx, dword [ebp - 0x2d40]
push eax
call fcn.00402580
mov esi, dword [ebp - 0x2d30]
mov ecx, esi
push eax
call fcn.00441a90
jmp 0x4412e8
mov esi, dword [ebp - 0x2d30]
test edi, edi
je 0x441343
call fcn.00473e75
push 0x588c30
lea ecx, [ebp - 0x273c]
call fcn.004024f0
push str.CreateProcessFlag
lea ecx, [ebp - 0x2724]
mov byte [ebp - 4], 0x73
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x273c]
push ecx
lea ecx, [ebp - 0x2724]
mov byte [ebp - 4], 0x74
push ecx
mov eax, dword [eax + 8]
mov ecx, ebx
call eax
lea ecx, [ebp - 0x2724]
call fcn.004024b0
lea ecx, [ebp - 0x273c]
jmp 0x441393
push 0x59e514
lea ecx, [ebp - 0x276c]
call fcn.004024f0
push str.CreateProcessFlag
lea ecx, [ebp - 0x2754]
mov byte [ebp - 4], 0x75
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x276c]
push ecx
lea ecx, [ebp - 0x2754]
mov byte [ebp - 4], 0x76
push ecx
mov eax, dword [eax + 8]
mov ecx, ebx
call eax
lea ecx, [ebp - 0x2754]
call fcn.004024b0
lea ecx, [ebp - 0x276c]
mov byte [ebp - 4], 0x69
call fcn.004024b0
mov edi, dword [ebp - 0x2d4c]
test edi, edi
je 0x4413c7
push dword [ebp - 0x2d28]
lea ecx, [ebp - 0x243c]
call fcn.00402580
push eax
mov ecx, edi
call fcn.00402580
push eax
mov ecx, esi
call fcn.00457640
call fcn.00402160
cmp dword [ebp - 0x23b0], 8
lea eax, [ebp - 0x23c4]
cmovae eax, dword [ebp - 0x23c4]
push eax
call fcn.004ce493
add esp, 4
lea ecx, [ebp - 0x252c]
call fcn.004024b0
lea ecx, [ebp - 0x24fc]
call fcn.004024b0
lea ecx, [ebp - 0x2d90]
call fcn.004059b0
lea ecx, [ebp - 0x23c4]
call fcn.004024b0
lea ecx, [ebp - 0x2454]
call fcn.004024b0
lea ecx, [ebp - 0x23dc]
call fcn.004024b0
lea ecx, [ebp - 0x2424]
call fcn.004024b0
lea ecx, [ebp - 0x24b4]
call fcn.004024b0
mov esi, dword [ebp - 0x2d44]
lea ecx, [ebp - 0x2dec]
call fcn.004059b0
lea ecx, [ebp - 0x2e64]
call fcn.004c043e
lea ecx, [ebp - 0x23f4]
call fcn.004024b0
lea ecx, [ebp - 0x243c]
call fcn.004024b0
lea ecx, [ebp - 0x2de0]
call fcn.004059b0
lea ecx, [ebp - 0x2dd4]
call fcn.004059b0
lea ecx, [ebp - 0x2dc8]
call fcn.004059b0
lea ecx, [ebp - 0x2dbc]
call fcn.004059b0
lea ecx, [ebp - 0x2df8]
call fcn.004059b0
lea ecx, [ebp - 0x2e34]
mov byte [ebp - 4], 0x13
call fcn.004059b0
test esi, esi
jne 0x44160e
push str.InstallSendDC
lea ecx, [ebp - 0x2784]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x2784]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x77
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x2784]
mov byte [ebp - 4], 0x13
mov edi, eax
call fcn.004024b0
push str.InstallSendSoft
lea ecx, [ebp - 0x27b4]
call fcn.004024f0
mov eax, dword [ebx]
lea ecx, [ebp - 0x27b4]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x78
mov eax, dword [eax + 0x1c]
call eax
lea ecx, [ebp - 0x27b4]
mov byte [ebp - 4], 0x13
mov esi, eax
call fcn.004024b0
call fcn.00402160
xor edx, edx
mov dword [ebp - 0x2d44], edx
test edi, edi
je 0x44159d
cmp dword [edi + 0x14], 8
jb 0x441544
mov edi, dword [edi]
mov eax, 0x588c30
nop dword [eax]
mov cx, word [edi]
cmp cx, word [eax]
jne 0x441586
test cx, cx
je 0x441572
mov cx, word [edi + 2]
cmp cx, word [eax + 2]
jne 0x441586
add edi, 4
add eax, 4
test cx, cx
jne 0x441550
xor eax, eax
mov edi, 1
test eax, eax
cmove edx, edi
mov dword [ebp - 0x2d44], edx
jmp 0x4415a2
sbb eax, eax
mov edi, 1
or eax, 1
test eax, eax
cmove edx, edi
mov dword [ebp - 0x2d44], edx
jmp 0x4415a2
mov edi, 1
call fcn.00402160
test esi, esi
je 0x4415f3
cmp dword [esi + 0x14], 8
jb 0x4415b3
mov esi, dword [esi]
mov eax, 0x588c30
mov cx, word [esi]
cmp cx, word [eax]
jne 0x4415e5
test cx, cx
je 0x4415da
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x4415e5
add esi, 4
add eax, 4
test cx, cx
jne 0x4415b8
xor ecx, ecx
xor eax, eax
test ecx, ecx
cmove eax, edi
jmp 0x4415f5
sbb ecx, ecx
xor eax, eax
or ecx, 1
test ecx, ecx
cmove eax, edi
jmp 0x4415f5
xor eax, eax
cmp dword [ebp - 0x2d44], 0
je 0x441602
test eax, eax
jne 0x44160e
mov ecx, dword [ebp - 0x2d30]
push ebx
call fcn.00444e50
lea ecx, [ebp - 0x2e28]
call fcn.004059b0
lea ecx, [ebp - 0x2e1c]
call fcn.004059b0
lea ecx, [ebp - 0x2e10]
call fcn.004059b0
lea ecx, [ebp - 0x249c]
call fcn.004024b0
lea ecx, [ebp - 0x2484]
call fcn.004024b0
lea ecx, [ebp - 0x237c]
call fcn.004024b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004682d0
mov esp, ebp
pop ebp
ret 4