Function at 0x401ef0
Capabilities:
Create directory
Create process on windows
Delete file
Extract resource via kernel32 functions
Get common file path
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0xcf0
mov edx, dword [esp + 0xcfc]
push ebx
push ebp
push esi
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor esi, esi
cmp ecx, esi
mov dword [esp + 0x10], 1
jg 0x401f1f
mov dword [esp + 0x10], esi
cmp byte [edx], 0x22
je 0x401f28
mov dword [esp + 0x10], esi
lea ebp, [ecx - 1]
xor ebx, ebx
mov eax, ebp
cmp eax, esi
jl 0x401f44
cmp byte [eax + edx], 0x22
je 0x401f3e
dec eax
jns 0x401f33
jmp 0x401f44
cmp eax, esi
mov ebx, eax
jne 0x401f48
mov dword [esp + 0x10], esi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x68]
rep stosd dword es:[edi], eax
mov eax, 1
cmp ebx, eax
jle 0x401f6e
lea esi, [esp + 0x68]
dec esi
mov cl, byte [eax + edx]
mov byte [esi + eax], cl
inc eax
cmp eax, ebx
jl 0x401f63
mov eax, ebp
xor esi, esi
cmp eax, 8
mov dword [esp + 0x3c], esi
jl 0x401faa
mov cl, byte [eax + edx]
cmp cl, 0x44
je 0x401fa2
cmp cl, 0x64
jne 0x401f9a
cmp byte [eax + edx - 1], 0x2f
jne 0x401f9a
cmp byte [eax + edx - 2], 0x20
jne 0x401f9a
cmp eax, ebx
jg 0x401fa2
dec eax
cmp eax, 8
jge 0x401f7b
jmp 0x401faa
mov dword [esp + 0x3c], 1
mov eax, ebp
mov dword [esp + 0x34], esi
cmp eax, 8
jl 0x401fe4
mov cl, byte [eax + edx]
cmp cl, 0x53
je 0x401fdc
cmp cl, 0x73
jne 0x401fd4
cmp byte [eax + edx - 1], 0x2f
jne 0x401fd4
cmp byte [eax + edx - 2], 0x20
jne 0x401fd4
cmp eax, ebx
jg 0x401fdc
dec eax
cmp eax, 8
jge 0x401fb5
jmp 0x401fe4
mov dword [esp + 0x34], 1
cmp dword [esp + 0x10], esi
je 0x402bce
lea edx, [esp + 0x68]
push edx
call fcn.00401780
add esp, 4
test eax, eax
jne 0x402022
lea eax, [esp + 0x68]
push eax
call fcn.00401d20
add esp, 4
test eax, eax
jne 0x402022
pop edi
pop esi
pop ebp
mov eax, 3
pop ebx
add esp, 0xcf0
ret 0x10
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xbfc]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xbfc]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x40205b
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0xcf0
ret 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x4e0]
lea edx, [esp + 0x4e0]
rep stosd dword es:[edi], eax
push edx
push esi
lea eax, [esp + 0xc04]
push 0x40e240
push eax
call ebx
test eax, eax
jne 0x40209f
pop edi
pop esi
pop ebp
mov eax, 5
pop ebx
add esp, 0xcf0
ret 0x10
push str.PACKAGE
push 0x69
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0
push 0
push 2
push 0
push 0
lea ecx, [esp + 0x4f4]
push 0x40000000
push ecx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4020fc
pop edi
pop esi
pop ebp
mov eax, 7
pop ebx
add esp, 0xcf0
ret 0x10
lea edx, [esp + 0x54]
push 0
push edx
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x6e8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x6e8]
lea ecx, [esp + 0xbfc]
push eax
push 0
push 0x40e240
push ecx
call ebx
test eax, eax
jne 0x402159
pop edi
pop esi
pop ebp
mov eax, 5
pop ebx
add esp, 0xcf0
ret 0x10
mov eax, dword [esp + 0xd04]
lea edx, [esp + 0x270]
push 0x64
push edx
push eax
mov byte [esp + 0x27c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [esp + 0x270]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea edx, [ebp - 3]
cmp edx, ebp
jge 0x4021af
sub ecx, edx
lea edi, [esp + edx + 0x270]
mov esi, ecx
mov eax, 0x7a7a7a7a
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
lea edi, [esp + 0x270]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x3b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp edx, ebp
rep movsb byte es:[edi], byte [esi]
jge 0x4021fc
mov ecx, ebp
lea edi, [esp + edx + 0x270]
sub ecx, edx
mov eax, 0x75757575
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea edi, [esp + 0x270]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x3b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x40e234
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x4e4]
push ecx
call fcn.00403bde
mov esi, eax
push 2
push 0
push esi
call fcn.00403b32
push esi
call fcn.004039da
push 0
push 0
push esi
mov ebx, eax
call fcn.00403b32
lea edx, [esp + 0x68]
push 5
push edx
push esi
call fcn.00401750
add esp, 0x30
xor ebp, ebp
xor edi, edi
lea eax, [esp + 0x2c]
push 1
push eax
push esi
call fcn.00401750
mov edx, dword [esp + 0x38]
mov ecx, edi
and edx, 0xff
add edi, 8
shl edx, cl
add esp, 0xc
add ebp, edx
cmp edi, 0x20
jb 0x40226b
mov dword [esp + 0x50], ebp
mov edi, 4
lea eax, [esp + 0x1f]
push 1
push eax
push esi
call fcn.00401750
add esp, 0xc
dec edi
jne 0x40229c
lea edi, [ebx - 0xd]
push edi
mov dword [esp + 0x3c], edi
call fcn.00403928
push edi
push eax
push esi
mov dword [esp + 0x3c], eax
call fcn.00401750
push esi
call fcn.004038d2
mov ecx, dword [esp + 0x58]
add esp, 0x14
mov bl, cl
xor esi, esi
cmp cl, 0x2d
mov byte [esp + 0x14], bl
mov dword [esp + 0x4c], esi
jb 0x40230a
and ecx, 0xff
mov eax, 0x6c16c16d
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
mov dword [esp + 0x4c], ecx
add bl, 0xd3
dec ecx
jne 0x402300
mov byte [esp + 0x14], bl
cmp bl, 9
mov dword [esp + 0x20], esi
jb 0x402334
mov ecx, dword [esp + 0x14]
mov eax, 0x38e38e39
and ecx, 0xff
mul ecx
shr edx, 1
mov dword [esp + 0x20], edx
add bl, 0xf7
dec edx
jne 0x40232a
mov byte [esp + 0x14], bl
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
and esi, 0xff
mov eax, 0x300
lea ecx, [edx + esi]
shl eax, cl
mov ecx, dword [esp + 0x50]
push ecx
lea ebp, [eax + eax + 0xe6c]
call fcn.00403928
push ebp
mov edi, eax
call fcn.00403928
mov ecx, dword [esp + 0x40]
mov ebx, eax
mov eax, dword [esp + 0x58]
lea edx, [esp + 0x48]
push edx
mov edx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x5c]
push edi
push ecx
mov ecx, dword [esp + 0x38]
push edx
push eax
push ecx
push esi
push ebp
push ebx
call fcn.00401380
mov ebp, dword [esp + 0x70]
lea edx, [esp + 0x718]
push 0x40e230
push edx
call fcn.00403bde
mov esi, eax
push esi
push ebp
push 1
push edi
call fcn.004037c8
add esp, 0x48
push esi
call fcn.004038d2
push ebx
call fcn.0040375f
push edi
call fcn.0040375f
mov eax, dword [esp + 0x38]
push eax
call fcn.0040375f
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x10
lea ecx, [esp + 0x4e0]
push ecx
call ebx
lea edx, [esp + 0x6e8]
push 0x40e22c
push edx
call fcn.00403bde
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x40240f
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
add esp, 0xcf0
ret 0x10
xor eax, eax
push ebp
push 3
lea ecx, [esp + 0x18]
mov word [esp + 0x18], ax
push 1
push ecx
mov byte [esp + 0x22], al
call fcn.004032e0
mov al, byte [esp + 0x20]
add esp, 0x10
cmp al, 0x48
jne 0x4032bf
cmp byte [esp + 0x11], 0x45
jne 0x4032bf
cmp byte [esp + 0x12], 0x4e
jne 0x4032bf
push ebp
push 1
lea edx, [esp + 0x20]
xor esi, esi
push 4
push edx
mov dword [esp + 0x28], esi
call fcn.004032e0
push ebp
push 1
lea eax, [esp + 0x48]
push 4
push eax
call fcn.004032e0
push ebp
push 1
lea ecx, [esp + 0x50]
push 4
push ecx
mov dword [esp + 0x58], 0xffffffff
call fcn.004032e0
mov eax, dword [esp + 0x48]
add esp, 0x30
cmp eax, esi
mov dword [esp + 0x14], esi
jle 0x40265b
push ebp
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xafc]
push 1
lea edx, [esp + 0x40]
push 4
push edx
rep stosd dword es:[edi], eax
call fcn.004032e0
mov eax, dword [esp + 0x48]
push ebp
push eax
lea ecx, [esp + 0xb10]
push 1
push ecx
call fcn.004032e0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18c]
add esp, 0x20
rep stosd dword es:[edi], eax
lea edi, [esp + 0x68]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x16c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x16c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x16b], 0x5c
je 0x402555
mov edi, 0x40e228
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x16c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xaf8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x16c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x30]
mov ecx, edx
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
je 0x4025c7
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
cmp eax, ecx
jne 0x4025c7
lea edi, [esp + 0x16c]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x3b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebp
push 1
lea ecx, [esp + 0x28]
push 4
push ecx
call fcn.004032e0
mov edx, dword [esp + 0x30]
push edx
call fcn.00403928
mov esi, eax
mov eax, dword [esp + 0x34]
push ebp
push eax
push 1
push esi
call fcn.004032e0
mov eax, dword [esp + 0x54]
add esp, 0x24
test eax, eax
je 0x40263d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
cmp ecx, eax
je 0x40263d
lea edx, [esp + 0x16c]
push 0x40e230
push edx
call fcn.00403bde
mov edi, eax
add esp, 8
test edi, edi
je 0x4027a9
mov eax, dword [esp + 0x20]
push edi
push eax
push 1
push esi
call fcn.004037c8
push edi
call fcn.004038d2
add esp, 0x14
push esi
call fcn.0040375f
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add esp, 4
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x40249c
push ebp
call fcn.004038d2
add esp, 4
lea ecx, [esp + 0x6e8]
push ecx
call ebx
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x3b4]
lea edx, [esp + 0x3b4]
rep stosd dword es:[edi], eax
mov edi, str.Foxit_Reader.exe_1
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push 0x411128
and ecx, 3
push 0x411128
push str.SOFTWAREClassesFoxitReader.DocumentDefaultIcon
push 0x80000002
rep movsb byte es:[edi], byte [esi]
call fcn.004019f0
mov esi, dword [sym.imp.SHELL32.dll_SHChangeNotify]
add esp, 0x14
push 0
push 0
push 0x1000
push 0x8000000
call esi
lea eax, [esp + 0x3b4]
push 1
push eax
push 0x411128
push str.SOFTWAREClassesFoxitReader.DocumentDefaultIcon
push 0x80000002
call fcn.004019f0
add esp, 0x14
push 0
push 0
push 0x1000
push 0x8000000
call esi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x7ec]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x3b4]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x7ec]
push ecx
push 0x411128
push 0x411128
push str.SoftwareClasses.pdf
push 0x80000002
call fcn.00401840
lea edx, [esp + 0x3c8]
push edx
push 0x411128
push str.CLSID
push str.SOFTWAREClassesMIMEDatabaseContent_Type_application_pdf
push 0x80000002
call fcn.00401840
add esp, 0x28
mov esi, str.FoxitReader.Document
lea eax, [esp + 0x7ec]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4027bb
test cl, cl
je 0x4027a5
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4027bb
add eax, 2
add esi, 2
test cl, cl
jne 0x402781
xor eax, eax
jmp 0x4027c0
pop edi
pop esi
pop ebp
mov eax, 0xe
pop ebx
add esp, 0xcf0
ret 0x10
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x402854
lea eax, [esp + 0x7ec]
push 1
push eax
push str.strdocument
push str.SoftwareFoxit_SoftwareFoxit_Reader
push 0x80000002
call fcn.004019f0
add esp, 0x14
test eax, eax
jne 0x40280e
lea ecx, [esp + 0x7ec]
push 1
push ecx
push str.strdocument
push str.SoftwareFoxit_SoftwareFoxit_Reader
push 0x80000001
call fcn.004019f0
add esp, 0x14
lea edx, [esp + 0x3b4]
push 1
push edx
push str.strCLSID
push str.SoftwareFoxit_SoftwareFoxit_Reader
push 0x80000002
call fcn.004019f0
add esp, 0x14
test eax, eax
jne 0x402854
lea eax, [esp + 0x3b4]
push 1
push eax
push str.strCLSID
push str.SoftwareFoxit_SoftwareFoxit_Reader
push 0x80000001
call fcn.004019f0
add esp, 0x14
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x5e4]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x8f0]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x68]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x67], 0x5c
je 0x4028b3
mov edi, 0x40e228
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x68]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea edi, [esp + 0x68]
xor eax, eax
lea edx, [esp + 0x5e4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x8f0]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea edi, [esp + 0x68]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, edx
lea edx, [esp + 0x5e4]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Foxit_Reader.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x8f0]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Uninstall.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x41
lea edi, [esp + 0x9f4]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x24]
push eax
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea ecx, [esp + 0x9f4]
mov edx, dword [esp + 0x24]
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4029d0
lea eax, [esp + 0x68]
lea ecx, [esp + 0x9f4]
push eax
push 0x40e03c
push ecx
push 0x40e03c
call fcn.00401bb0
add esp, 0x10
test eax, eax
jne 0x4029d0
pop edi
pop esi
pop ebp
mov eax, 0xc
pop ebx
add esp, 0xcf0
ret 0x10
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4029fb
lea edx, [esp + 0x68]
push edx
call fcn.00401de0
add esp, 4
test eax, eax
jne 0x4029fb
pop edi
pop esi
pop ebp
mov eax, 0xc
pop ebx
add esp, 0xcf0
ret 0x10
lea eax, [esp + 0x8f0]
push 1
push eax
push str.UninstallString
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallFoxit_Reader
push 0x80000002
call fcn.004019f0
add esp, 0x14
test eax, eax
jne 0x402a57
lea ecx, [esp + 0x8f0]
push 1
push ecx
push str.UninstallString
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallFoxit_Reader
push 0x80000001
call fcn.004019f0
add esp, 0x14
test eax, eax
jne 0x402a57
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
add esp, 0xcf0
ret 0x10
push 1
push 0x40e03c
push str.DisplayName
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallFoxit_Reader
push 0x80000002
call fcn.004019f0
add esp, 0x14
test eax, eax
jne 0x402aad
push 1
push 0x40e03c
push str.DisplayName
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallFoxit_Reader
push 0x80000001
call fcn.004019f0
add esp, 0x14
test eax, eax
jne 0x402aad
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
add esp, 0xcf0
ret 0x10
lea edx, [esp + 0x5e4]
push 1
push edx
push str.DisplayIcon
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallFoxit_Reader
push 0x80000002
call fcn.004019f0
add esp, 0x14
test eax, eax
jne 0x402b09
lea eax, [esp + 0x5e4]
push 1
push eax
push str.DisplayIcon
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallFoxit_Reader
push 0x80000001
call fcn.004019f0
add esp, 0x14
test eax, eax
jne 0x402b09
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
add esp, 0xcf0
ret 0x10
lea ecx, [esp + 0x8f0]
push 1
push ecx
push str.UninstallPath
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallFoxit_Reader
push 0x80000002
call fcn.004019f0
add esp, 0x14
test eax, eax
jne 0x402b65
lea edx, [esp + 0x8f0]
push 1
push edx
push str.UninstallPath
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallFoxit_Reader
push 0x80000001
call fcn.004019f0
add esp, 0x14
test eax, eax
jne 0x402b65
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
add esp, 0xcf0
ret 0x10
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x68]
push 1
push eax
push str.InstallPath
push str.SoftwareFoxit_SoftwareFoxit_Reader
push 0x80000002
call fcn.004019f0
add esp, 0x14
test eax, eax
jne 0x4032ad
lea ecx, [esp + 0x68]
push 1
push ecx
push str.InstallPath
push str.SoftwareFoxit_SoftwareFoxit_Reader
push 0x80000001
call fcn.004019f0
add esp, 0x14
test eax, eax
jne 0x4032ad
pop edi
pop esi
pop ebp
mov eax, 0xa
pop ebx
add esp, 0xcf0
ret 0x10
lea edx, [esp + 0x7ec]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x7ec]
push edx
push 0x104
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x402c07
pop edi
pop esi
pop ebp
mov eax, 4
pop ebx
add esp, 0xcf0
ret 0x10
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x5e4]
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x5e4]
lea ecx, [esp + 0x7ec]
push eax
push 0
push 0x40e240
push ecx
call ebx
test eax, eax
jne 0x402c4c
pop edi
pop esi
pop ebp
mov eax, 5
pop ebx
add esp, 0xcf0
ret 0x10
push str.PACKAGE
push 0x69
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push 0
push 0
push 2
push 0
push 0
lea edx, [esp + 0x5f8]
push 0x40000000
push edx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x402ca9
pop edi
pop esi
pop ebp
mov eax, 7
pop ebx
add esp, 0xcf0
ret 0x10
lea eax, [esp + 0x54]
push 0
push eax
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x4e0]
lea edx, [esp + 0x7ec]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x4e0]
push ecx
push eax
push 0x40e240
push edx
call ebx
test eax, eax
jne 0x402d05
pop edi
pop esi
pop ebp
mov eax, 5
pop ebx
add esp, 0xcf0
ret 0x10
mov ecx, dword [esp + 0xd04]
lea eax, [esp + 0x270]
push 0x64
push eax
push ecx
mov byte [esp + 0x27c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [esp + 0x270]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea edx, [ebp - 3]
cmp edx, ebp
jge 0x402d5b
sub ecx, edx
lea edi, [esp + edx + 0x270]
mov esi, ecx
mov eax, 0x7a7a7a7a
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
lea edi, [esp + 0x270]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0x3b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp edx, ebp
rep movsb byte es:[edi], byte [esi]
jge 0x402da8
mov ecx, ebp
lea edi, [esp + edx + 0x270]
sub ecx, edx
mov eax, 0x75757575
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea edi, [esp + 0x270]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x3b4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x40e234
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x5e8]
push ecx
call fcn.00403bde
mov esi, eax
push 2
push 0
push esi
call fcn.00403b32
push esi
call fcn.004039da
push 0
push 0
push esi
mov ebx, eax
call fcn.00403b32
lea edx, [esp + 0x68]
push 5
push edx
push esi
call fcn.00401750
add esp, 0x30
xor ebp, ebp
xor edi, edi
lea eax, [esp + 0x24]
push 1
push eax
push esi
call fcn.00401750
mov edx, dword [esp + 0x30]
mov ecx, edi
and edx, 0xff
add edi, 8
shl edx, cl
add esp, 0xc
add ebp, edx
cmp edi, 0x20
jb 0x402e17
mov dword [esp + 0x34], ebp
mov edi, 4
lea eax, [esp + 0x1f]
push 1
push eax
push esi
call fcn.00401750
add esp, 0xc
dec edi
jne 0x402e48
lea edi, [ebx - 0xd]
push edi
mov dword [esp + 0x28], edi
call fcn.00403928
push edi
push eax
push esi
mov dword [esp + 0x40], eax
call fcn.00401750
push esi
call fcn.004038d2
mov ecx, dword [esp + 0x58]
add esp, 0x14
mov bl, cl
xor esi, esi
cmp cl, 0x2d
mov byte [esp + 0x14], bl
mov dword [esp + 0x3c], esi
jb 0x402eb6
and ecx, 0xff
mov eax, 0x6c16c16d
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
mov dword [esp + 0x3c], ecx
add bl, 0xd3
dec ecx
jne 0x402eac
mov byte [esp + 0x14], bl
cmp bl, 9
mov dword [esp + 0x18], esi
jb 0x402ee0
mov ecx, dword [esp + 0x14]
mov eax, 0x38e38e39
and ecx, 0xff
mul ecx
shr edx, 1
mov dword [esp + 0x18], edx
add bl, 0xf7
dec edx
jne 0x402ed6
mov byte [esp + 0x14], bl
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
and esi, 0xff
mov eax, 0x300
lea ecx, [edx + esi]
shl eax, cl
mov ecx, dword [esp + 0x34]
push ecx
lea ebp, [eax + eax + 0xe6c]
call fcn.00403928
push ebp
mov edi, eax
call fcn.00403928
mov ecx, dword [esp + 0x2c]
mov ebx, eax
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x48]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x4c]
push edi
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
push ecx
push esi
push ebp
push ebx
call fcn.00401380
mov ebp, dword [esp + 0x70]
lea edx, [esp + 0x510]
push 0x40e230
push edx
call fcn.00403bde
mov esi, eax
push esi
push ebp
push 1
push edi
call fcn.004037c8
add esp, 0x48
push esi
call fcn.004038d2
push ebx
call fcn.0040375f
push edi
call fcn.0040375f
mov eax, dword [esp + 0x3c]
push eax
call fcn.0040375f
add esp, 0x10
lea ecx, [esp + 0x5e4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x6e8]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x6e8]
push edx
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x7f4]
push 0x40e240
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x402fce
pop edi
pop esi
pop ebp
mov eax, 5
pop ebx
add esp, 0xcf0
ret 0x10
lea ecx, [esp + 0x6e8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0x6e8]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, 0x41
lea esi, [esp + 0x6e8]
lea edi, [esp + 0x68]
lea eax, [esp + 0x4e0]
push 0x40e22c
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.00403bde
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x40302b
pop edi
pop esi
pop ebp
mov eax, 8
pop ebx
add esp, 0xcf0
ret 0x10
xor ecx, ecx
push ebp
push 3
lea edx, [esp + 0x18]
mov word [esp + 0x18], cx
push 1
push edx
mov byte [esp + 0x22], cl
call fcn.004032e0
mov al, byte [esp + 0x20]
add esp, 0x10
cmp al, 0x48
jne 0x4032bf
cmp byte [esp + 0x11], 0x45
jne 0x4032bf
cmp byte [esp + 0x12], 0x4e
jne 0x4032bf
push ebp
push 1
lea eax, [esp + 0x30]
xor ebx, ebx
push 4
push eax
mov dword [esp + 0x38], ebx
call fcn.004032e0
push ebp
push 1
lea ecx, [esp + 0x50]
push 4
push ecx
call fcn.004032e0
push ebp
push 1
lea edx, [esp + 0x54]
push 4
push edx
mov dword [esp + 0x5c], 0xffffffff
call fcn.004032e0
mov eax, dword [esp + 0x58]
add esp, 0x30
cmp eax, ebx
jle 0x403259
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x9f4]
push ebp
rep stosd dword es:[edi], eax
push 1
lea eax, [esp + 0x2c]
push 4
push eax
call fcn.004032e0
mov ecx, dword [esp + 0x34]
push ebp
push ecx
lea edx, [esp + 0xa0c]
push 1
push edx
call fcn.004032e0
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18c]
add esp, 0x20
rep stosd dword es:[edi], eax
lea edi, [esp + 0x68]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x16c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x16c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x16b], 0x5c
je 0x40316d
mov edi, 0x40e228
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x16c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x9f4]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x16c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x38]
mov ecx, edx
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
je 0x4031e7
cmp ebx, dword [esp + 0x2c]
jne 0x4031e7
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xaf8]
lea edx, [esp + 0xaf8]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x16c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x16c]
push 0x40e230
push ecx
call fcn.00403bde
mov edi, eax
add esp, 8
test edi, edi
je 0x4027a9
push ebp
push 1
lea edx, [esp + 0x20]
push 4
push edx
call fcn.004032e0
mov eax, dword [esp + 0x28]
push eax
call fcn.00403928
mov ecx, dword [esp + 0x2c]
push ebp
mov esi, eax
push ecx
push 1
push esi
call fcn.004032e0
mov edx, dword [esp + 0x3c]
push edi
push edx
push 1
push esi
call fcn.004037c8
push esi
call fcn.0040375f
push edi
call fcn.004038d2
mov eax, dword [esp + 0x64]
add esp, 0x3c
inc ebx
cmp ebx, eax
jl 0x4030b4
push ebp
call fcn.004038d2
add esp, 4
lea eax, [esp + 0x4e0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x374]
mov dword [esp + 0x370], 0x44
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x58]
lea edx, [esp + 0x370]
push ecx
push edx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0xb1c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xcf0
ret 0x10
pop edi
pop esi
pop ebp
mov eax, 9
pop ebx
add esp, 0xcf0
ret 0x10