Function at 0x43d5d0
Capabilities:
Accept command line arguments
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x15ac
call fcn.00584c40
push ebx
push esi
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
je 0x43d62b
sub esp, 0x10
lea ecx, [esp + 0x1208]
call fcn.00445210
mov eax, dword [0x6b43a0]
push 0
push 0
mov ecx, dword [eax + 4]
lea eax, [esp + 0x1204]
add ecx, 0x6b43a0
mov dword [ecx + 0x38], eax
call fcn.00436630
lea ecx, [esp + 0x11f8]
call fcn.0043ff10
mov eax, dword [str.Start]
lea edx, [esp + 0x28]
mov dword [esp + 0x28], 0
xor ecx, ecx
mov dword [esp + 0x28], eax
mov al, byte [0x5de0d8]
mov byte [esp + 0x2c], al
lea eax, [esp + 0x18]
push eax
push 0x3f2
lea eax, [esp + 0x50]
mov dword [esp + 0x20], 0
push 0x5def08
push eax
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x6c], 0xf
mov dword [esp + 0x68], 0
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], 5
mov byte [esp + 0x3d], 0
call fcn.004d4b60
mov ecx, dword [esp + 0x4c]
add esp, 0x10
cmp ecx, 0x10
jb 0x43d6e2
mov edx, dword [esp + 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43d6d8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43feee
push ecx
push edx
call fcn.00583877
add esp, 8
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0xf
mov byte [esp + 0x28], 0
cmp ecx, 0x10
jb 0x43d72d
mov edx, dword [esp + 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43d723
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43feee
push ecx
push edx
call fcn.00583877
add esp, 8
mov edi, dword [esp + 0x18]
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0xf
mov byte [esp + 0x48], 0
test edi, edi
je 0x43d7ab
mov ebx, dword [esp + 0x1c]
mov esi, edi
cmp esi, ebx
je 0x43d762
mov ecx, esi
call fcn.00438e00
add esi, 0x40
cmp esi, ebx
jne 0x43d754
mov ecx, dword [esp + 0x20]
mov eax, edi
sub ecx, edi
and ecx, 0xffffffc0
cmp ecx, 0x1000
jb 0x43d789
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43feee
push ecx
push edi
call fcn.00583877
add esp, 8
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0xc0], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00598a72
add esp, 4
mov ecx, 0x6acf04
push 0
push 0x5dd63c
call fcn.004496e0
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
je 0x43d844
mov eax, dword [esp + 0x24]
cmp eax, 1
jle 0x43d844
mov ecx, dword [esi + 4]
cmp word [ecx], 0x2d
je 0x43d80f
push ecx
mov ecx, 0x6acf04
call fcn.00446d50
mov eax, dword [esp + 0x24]
push eax
push esi
mov edx, str.terminal
lea ecx, [esp + 0x6b]
call fcn.0043c350
add esp, 8
test al, al
je 0x43d82d
mov byte [0x6d17a5], 1
push dword [esp + 0x24]
mov edx, str.install_service
mov ecx, 0x6c54ca
push esi
call fcn.0043c350
add esp, 8
mov byte [0x6c54a4], 0
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp byte [0x6c54ca], 0
mov dword [0x6c54a0], eax
je 0x43dd6b
cmp dword [0x6acf18], 8
mov ecx, 0x6acf04
mov eax, dword [0x6acf14]
cmovae ecx, dword [0x6acf04]
cmp eax, 1
jne 0x43d896
push eax
mov edx, 0x5de110
call fcn.00450520
add esp, 4
test eax, eax
je 0x43dd6b
call fcn.00456880
test al, al
je 0x43dc93
mov edx, dword [esp + 0x24]
mov ecx, esi
call fcn.00442ce0
push 0xc
push str.run_as_admin
lea ecx, [esp + 0x348]
mov dword [esp + 0x348], 0
mov dword [esp + 0x358], 0
mov dword [esp + 0x35c], 0xf
call fcn.00449cf0
fld1
lea eax, [esp + 0x340]
sub esp, 8
lea ecx, [esp + 0xbb0]
fstp qword [esp]
push eax
call fcn.004d2c00
lea ecx, [esp + 0xba8]
push ecx
lea eax, [esp + 0xbec]
push eax
push ecx
lea ecx, [esp + 0x2c8]
call fcn.004456c0
push 0x2d
push str.__Stopping__removing_and_installing_service
lea ecx, [esp + 0x330]
mov dword [esp + 0x330], 0
mov dword [esp + 0x340], 0
mov dword [esp + 0x344], 0xf
call fcn.00449cf0
push 4
push str.main
lea ecx, [esp + 0x318]
mov dword [esp + 0x318], 0
mov dword [esp + 0x328], 0
mov dword [esp + 0x32c], 0xf
call fcn.00449cf0
lea eax, [esp + 0x2bc]
xor ecx, ecx
push eax
push 0x41e
lea eax, [esp + 0x330]
push 0x5def08
push eax
lea edx, [esp + 0x320]
call fcn.004d4b60
add esp, 0x10
lea ecx, [esp + 0x310]
call fcn.004470b0
lea ecx, [esp + 0x328]
call fcn.004470b0
lea ecx, [esp + 0x2bc]
call fcn.00449240
push fcn.00438e00
push 1
push 0x40
lea eax, [esp + 0xbb4]
push eax
call fcn.00583d37
lea ecx, [esp + 0x340]
call fcn.004470b0
call fcn.004566b0
call fcn.004563f0
push 0x6acea4
push 0x5ddf9c
lea ecx, [esp + 0x980]
call fcn.00446ee0
mov edx, eax
lea ecx, [esp + 0x964]
call fcn.0044ce40
add esp, 4
mov ecx, eax
call fcn.00455f80
lea ecx, [esp + 0x960]
mov bl, al
call fcn.00449550
lea ecx, [esp + 0x978]
call fcn.00449550
test bl, bl
je 0x43dbf9
call fcn.00456550
test al, al
je 0x43db5f
push str.Service_installed_as_watchdog
lea ecx, [esp + 0x584]
mov dword [esp + 0x20c], 0
mov dword [esp + 0x210], 0
mov dword [esp + 0x214], 0
call fcn.004471f0
push str.main
lea ecx, [esp + 0x56c]
call fcn.004471f0
lea eax, [esp + 0x208]
xor ecx, ecx
push eax
push 0x424
lea eax, [esp + 0x588]
push 0x5def08
push eax
lea edx, [esp + 0x578]
call fcn.004d4b60
add esp, 0x10
lea ecx, [esp + 0x568]
call fcn.004470b0
lea ecx, [esp + 0x580]
call fcn.004470b0
lea ecx, [esp + 0x208]
call fcn.00449240
push 0x58
call fcn.005838a8
add esp, 4
mov ecx, 0x6acebc
mov esi, eax
call fcn.00446cf0
push eax
mov ecx, esi
call fcn.00452ec0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov dword [0x6c54c4], eax
mov ecx, eax
call fcn.004531f0
test al, al
jne 0x43db34
push 0x64
call edi
inc esi
cmp esi, 0xa
jge 0x43db34
mov eax, dword [0x6c54c4]
jmp 0x43db18
mov esi, dword [0x6c54c4]
test esi, esi
je 0x43db50
mov ecx, esi
call fcn.00452fc0
push 0x58
push esi
call fcn.00583877
add esp, 8
mov dword [0x6c54c4], 0
jmp 0x43dd76
push str.Cant_start_service
lea ecx, [esp + 0x5b4]
mov dword [esp + 0x200], 0
mov dword [esp + 0x204], 0
mov dword [esp + 0x208], 0
call fcn.004471f0
push str.service_start
lea ecx, [esp + 0x59c]
call fcn.004471f0
lea eax, [esp + 0x1fc]
mov ecx, 2
push eax
push 0x434
lea eax, [esp + 0x5b8]
push 0x5def08
push eax
lea edx, [esp + 0x5a8]
call fcn.004d4b60
add esp, 0x10
lea ecx, [esp + 0x598]
call fcn.004470b0
lea ecx, [esp + 0x5b0]
call fcn.004470b0
lea ecx, [esp + 0x1fc]
call fcn.00449240
jmp 0x43dd76
push str.Service_installation
lea ecx, [esp + 0x5e4]
mov dword [esp + 0x1f4], 0
mov dword [esp + 0x1f8], 0
mov dword [esp + 0x1fc], 0
call fcn.004471f0
push str.service_install
lea ecx, [esp + 0x5cc]
call fcn.004471f0
lea eax, [esp + 0x1f0]
mov ecx, 2
push eax
push 0x438
lea eax, [esp + 0x5e8]
push 0x5def08
push eax
lea edx, [esp + 0x5d8]
call fcn.004d4b60
add esp, 0x10
lea ecx, [esp + 0x5c8]
call fcn.004470b0
lea ecx, [esp + 0x5e0]
call fcn.004470b0
lea ecx, [esp + 0x1f0]
call fcn.00449240
jmp 0x43dd76
push 0x4a
push str.__install_service__has_no_effect_if_running_not_under_administrator_rights
lea ecx, [esp + 0x378]
mov dword [esp + 0x1ec], 0
mov dword [esp + 0x1f0], 0
mov dword [esp + 0x1f4], 0
mov dword [esp + 0x378], 0
mov dword [esp + 0x388], 0
mov dword [esp + 0x38c], 0xf
call fcn.00449cf0
push 4
push str.main
lea ecx, [esp + 0x360]
mov dword [esp + 0x360], 0
mov dword [esp + 0x370], 0
mov dword [esp + 0x374], 0xf
call fcn.00449cf0
lea eax, [esp + 0x1e4]
xor ecx, ecx
push eax
push 0x43c
lea eax, [esp + 0x378]
push 0x5def08
push eax
lea edx, [esp + 0x368]
call fcn.004d4b60
add esp, 0x10
lea ecx, [esp + 0x358]
call fcn.004470b0
lea ecx, [esp + 0x370]
call fcn.004470b0
lea ecx, [esp + 0x1e4]
call fcn.00449240
mov edx, dword [esp + 0x24]
mov ecx, esi
call fcn.00442ce0
cmp dword [0x6acf18], 8
mov ecx, 0x6acf04
mov edi, dword [0x6acf04]
mov esi, dword [0x6acf14]
setae bl
cmovae ecx, edi
cmp esi, 1
jne 0x43ddcf
push esi
mov edx, 0x5de204
call fcn.00450520
add esp, 4
test eax, eax
jne 0x43ddcf
call fcn.0043bad0
test al, al
je 0x43e38f
lea ecx, [esp + 0xc0]
call fcn.004445f0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
test bl, bl
mov ecx, 0x6acf04
cmovne ecx, edi
cmp esi, 1
jne 0x43df0e
push esi
mov edx, 0x5de208
call fcn.00450520
add esp, 4
test eax, eax
jne 0x43df0e
push 0x13
push str.Running_as_elevator
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], 0xf
call fcn.00449cf0
push 4
push str.main
lea ecx, [esp + 0x50]
mov dword [esp + 0x50], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0xf
call fcn.00449cf0
lea eax, [esp + 0x18]
xor ecx, ecx
push eax
push 0x44c
lea eax, [esp + 0x30]
push 0x5def08
push eax
lea edx, [esp + 0x58]
call fcn.004d4b60
mov ecx, dword [esp + 0x6c]
add esp, 0x10
cmp ecx, 0x10
jb 0x43dea4
mov edx, dword [esp + 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43de9a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43feee
push ecx
push edx
call fcn.00583877
add esp, 8
mov ecx, dword [esp + 0x3c]
cmp ecx, 0x10
jb 0x43deda
mov edx, dword [esp + 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43ded0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43feee
push ecx
push edx
call fcn.00583877
add esp, 8
lea ecx, [esp + 0x18]
call fcn.00449240
push ecx
mov ecx, dword [0x6c54a0]
mov edx, str.runner
call fcn.00456800
add esp, 4
lea ecx, [esp + 0xc0]
call fcn.004445f0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, 0x5de110
mov ecx, 0x6acf04
call fcn.0044d4d0
test al, al
je 0x43dff1
push 0x1b
push str.Running_as_watchdog_service
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0xf
call fcn.00449cf0
push 4
push str.main
lea ecx, [esp + 0x50]
mov dword [esp + 0x50], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0xf
call fcn.00449cf0
lea eax, [esp + 0x18]
xor ecx, ecx
push eax
push 0x452
lea eax, [esp + 0x30]
push 0x5def08
push eax
lea edx, [esp + 0x58]
call fcn.004d4b60
add esp, 0x10
lea ecx, [esp + 0x48]
call fcn.004470b0
lea ecx, [esp + 0x28]
call fcn.004470b0
lea ecx, [esp + 0x18]
call fcn.00449240
push ecx
mov edx, str.watchdog
xor ecx, ecx
call fcn.00456800
add esp, 4
lea ecx, [esp + 0xc0]
call fcn.004445f0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, 0x5de250
mov ecx, 0x6acf04
call fcn.0044d4d0
test al, al
je 0x43e0a0
push str.Running_as_cad_simulator
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call fcn.004471f0
push str.main
lea ecx, [esp + 0x4c]
call fcn.004471f0
lea eax, [esp + 0x18]
xor ecx, ecx
push eax
push 0x458
lea eax, [esp + 0x30]
push 0x5def08
push eax
lea edx, [esp + 0x58]
call fcn.004d4b60
add esp, 0x10
lea ecx, [esp + 0x48]
call fcn.004470b0
lea ecx, [esp + 0x28]
call fcn.004470b0
lea ecx, [esp + 0x18]
call fcn.00449240
push ecx
mov edx, 0x5de270
xor ecx, ecx
call fcn.00456800
add esp, 4
lea ecx, [esp + 0xc0]
call fcn.004445f0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, 0x5de274
mov ecx, 0x6acf04
call fcn.0044d4d0
test al, al
je 0x43e149
push str.Running_by_service
lea ecx, [esp + 0x614]
mov dword [esp + 0x218], 0
mov dword [esp + 0x21c], 0
mov dword [esp + 0x220], 0
call fcn.004471f0
push str.main
lea ecx, [esp + 0x5fc]
call fcn.004471f0
lea eax, [esp + 0x214]
xor ecx, ecx
push eax
push 0x45d
lea eax, [esp + 0x618]
push 0x5def08
push eax
lea edx, [esp + 0x608]
call fcn.004d4b60
add esp, 0x10
lea ecx, [esp + 0x5f8]
call fcn.004470b0
lea ecx, [esp + 0x610]
call fcn.004470b0
lea ecx, [esp + 0x214]
jmp 0x43e38a
push str.mode
lea ecx, [esp + 0x65c]
call fcn.004471f0
push 0x6acf04
lea eax, [esp + 0x65c]
push eax
lea ecx, [esp + 0xbf0]
call fcn.004d2ca0
lea ecx, [esp + 0xbe8]
push ecx
lea eax, [esp + 0xc2c]
push eax
push ecx
lea ecx, [esp + 0x2d4]
call fcn.004456c0
push 0x5de294
lea ecx, [esp + 0x644]
call fcn.004471f0
push str.main
lea ecx, [esp + 0x62c]
call fcn.004471f0
lea eax, [esp + 0x2c8]
xor ecx, ecx
push eax
push 0x460
lea eax, [esp + 0x648]
push 0x5def08
push eax
lea edx, [esp + 0x638]
call fcn.004d4b60
add esp, 0x10
lea ecx, [esp + 0x628]
call fcn.004470b0
lea ecx, [esp + 0x640]
call fcn.004470b0
lea ecx, [esp + 0x2c8]
call fcn.00449240
push fcn.00438e00
push 1
push 0x40
lea eax, [esp + 0xbf4]
push eax
call fcn.00583d37
lea ecx, [esp + 0x658]
call fcn.004470b0
mov edx, 0x5de078
mov ecx, 0x6acf04
call fcn.0044d3d0
test al, al
je 0x43e2cf
call fcn.0043bad0
test al, al
je 0x43e2cf
push str.The_app_is_already_running.._exiting
lea ecx, [esp + 0x2c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
call fcn.004471f0
push str.main
lea ecx, [esp + 0x4c]
call fcn.004471f0
lea eax, [esp + 0x18]
xor ecx, ecx
push eax
push 0x462
lea eax, [esp + 0x30]
push 0x5def08
push eax
lea edx, [esp + 0x58]
call fcn.004d4b60
add esp, 0x10
lea ecx, [esp + 0x48]
call fcn.004470b0
lea ecx, [esp + 0x28]
call fcn.004470b0
lea ecx, [esp + 0x18]
call fcn.00449240
lea ecx, [esp + 0xc0]
call fcn.004445f0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp byte [0x6c54ca], 0
jne 0x43e38f
call fcn.005201a0
mov ecx, eax
call fcn.00437fe0
test al, al
je 0x43e38f
call fcn.0043c580
test al, al
jne 0x43fed7
push str.Cant_elevate_process
lea ecx, [esp + 0x68c]
mov dword [esp + 0x128], 0
mov dword [esp + 0x12c], 0
mov dword [esp + 0x130], 0
call fcn.004471f0
push str.cant_elevate
lea ecx, [esp + 0x674]
call fcn.004471f0
lea eax, [esp + 0x124]
xor ecx, ecx
push eax
push 0x469
lea eax, [esp + 0x690]
push 0x5def08
push eax
lea edx, [esp + 0x680]
call fcn.004d4b60
add esp, 0x10
lea ecx, [esp + 0x670]
call fcn.004470b0
lea ecx, [esp + 0x688]
call fcn.004470b0
lea ecx, [esp + 0x124]
call fcn.00449240
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [str.build]
mov edi, eax
mov dword [esp + 0xc4], 0
lea eax, [esp + 0xc4]
mov dword [esp + 0xc4], ecx
mov cl, byte [0x5de2ec]
mov byte [esp + 0xc8], cl
lea ecx, [esp + 0x520]
push eax
mov dword [esp + 0x44], edi
mov dword [esp + 0xdc], 0xf
mov dword [esp + 0xd8], 5
mov byte [esp + 0xcd], 0
call fcn.00447260
fld qword [0x5f4710]
lea ecx, [esp + 0x520]
push ecx
lea eax, [esp + 0x564]
mov dword [esp + 0x53c], 0
push eax
push ecx
lea ecx, [esp + 0x2e0]
mov dword [esp + 0x554], 0
fstp qword [esp + 0x55c]
mov dword [esp + 0x558], 0xf
mov byte [esp + 0x564], 0
call fcn.004456c0
mov eax, dword [str.AeroAdmin_]
lea edx, [esp + 0x70]
mov dword [esp + 0xa0], 0
mov ecx, 6
mov dword [esp + 0xa0], eax
mov eax, dword [0x5de2f4]
mov dword [esp + 0xa4], eax
mov eax, dword [0x5de2f8]
mov dword [esp + 0xa8], eax
mov eax, dword [str.adminbuild]
mov dword [esp + 0x70], 0
mov dword [esp + 0x70], eax
mov eax, dword [0x5de304]
mov dword [esp + 0x74], eax
mov ax, word [0x5de308]
mov word [esp + 0x78], ax
lea eax, [esp + 0x2d4]
push eax
push 0x470
lea eax, [esp + 0xa8]
mov dword [esp + 0xbc], 0xf
push 0x5def08
push eax
mov dword [esp + 0xc0], 0xc
mov byte [esp + 0xbc], 0
mov dword [esp + 0x94], 0xf
mov dword [esp + 0x90], 0xa
mov byte [esp + 0x8a], 0
call fcn.004d4b60
mov ecx, dword [esp + 0x94]
add esp, 0x10
cmp ecx, 0x10
jb 0x43e53b
mov edx, dword [esp + 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43e531
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43fef3
push ecx
push edx
call fcn.00583877
add esp, 8
mov ecx, dword [esp + 0xb4]
mov dword [esp + 0x80], 0
mov dword [esp + 0x84], 0xf
mov byte [esp + 0x70], 0
cmp ecx, 0x10
jb 0x43e592
mov edx, dword [esp + 0xa0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43e588
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43fef3
push ecx
push edx
call fcn.00583877
add esp, 8
lea ecx, [esp + 0x2d4]
mov dword [esp + 0xb0], 0
mov dword [esp + 0xb4], 0xf
mov byte [esp + 0xa0], 0
call fcn.00449240
push fcn.00438e00
push 1
push 0x40
lea eax, [esp + 0x52c]
push eax
call fcn.00583d37
mov ecx, dword [esp + 0xd8]
cmp ecx, 0x10
jb 0x43e60e
mov edx, dword [esp + 0xc4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43e604
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43fef3
push ecx
push edx
call fcn.00583877
add esp, 8
push 0x118
lea eax, [esp + 0xc70]
mov dword [esp + 0xd8], 0
push 0
push eax
mov dword [esp + 0xe4], 0xf
mov byte [esp + 0xd0], 0
call fcn.00585a40
add esp, 0xc
mov dword [esp + 0xc68], 0x11c
lea eax, [esp + 0xc68]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 5
push str.major
lea ecx, [esp + 0x18c]
mov dword [esp + 0x18c], 0
mov dword [esp + 0x19c], 0
mov dword [esp + 0x1a0], 0xf
call fcn.00449cf0
mov eax, dword [esp + 0xc6c]
fild dword [esp + 0xc6c]
test eax, eax
jns 0x43e6a8
fadd qword [0x5f4758]
lea eax, [esp + 0x184]
push eax
lea ecx, [esp + 0x774]
fstp qword [esp + 0x14]
call fcn.00447260
fld qword [esp + 0x10]
lea ecx, [esp + 0x16c]
push 5
push str.minor
fstp qword [esp + 0x7a8]
mov dword [esp + 0x790], 0
mov dword [esp + 0x7a0], 0
mov dword [esp + 0x7a4], 0xf
mov byte [esp + 0x7b0], 0
mov dword [esp + 0x174], 0
mov dword [esp + 0x184], 0
mov dword [esp + 0x188], 0xf
call fcn.00449cf0
mov eax, dword [esp + 0xc70]
fild dword [esp + 0xc70]
test eax, eax
jns 0x43e740
fadd qword [0x5f4758]
lea eax, [esp + 0x16c]
push eax
lea ecx, [esp + 0x7b4]
fstp qword [esp + 0x14]
call fcn.00447260
fld qword [esp + 0x10]
lea ecx, [esp + 0x154]
push 5
push str.build
fstp qword [esp + 0x7e8]
mov dword [esp + 0x7d0], 0
mov dword [esp + 0x7e0], 0
mov dword [esp + 0x7e4], 0xf
mov byte [esp + 0x7f0], 0
mov dword [esp + 0x15c], 0
mov dword [esp + 0x16c], 0
mov dword [esp + 0x170], 0xf
call fcn.00449cf0
mov eax, dword [esp + 0xc74]
fild dword [esp + 0xc74]
test eax, eax
jns 0x43e7d8
fadd qword [0x5f4758]
lea eax, [esp + 0x154]
push eax
lea ecx, [esp + 0x7f4]
fstp qword [esp + 0x14]
call fcn.00447260
fld qword [esp + 0x10]
lea ecx, [esp + 0xc7c]
fstp qword [esp + 0x820]
mov dword [esp + 0x808], 0
lea edx, [ecx + 2]
mov dword [esp + 0x818], 0
mov dword [esp + 0x81c], 0xf
mov byte [esp + 0x828], 0
mov dword [esp + 0xdc], 0
mov dword [esp + 0xec], 0
mov dword [esp + 0xf0], 7
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43e850
sub ecx, edx
lea eax, [esp + 0xc7c]
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0xe4]
call fcn.004496e0
mov eax, dword [str.service_pack]
lea ecx, [esp + 0x830]
mov dword [esp + 0x88], 0
mov dword [esp + 0x88], eax
mov eax, dword [0x5de320]
mov dword [esp + 0x8c], eax
mov eax, dword [0x5de324]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x88]
push eax
mov dword [esp + 0xa0], 0xf
mov dword [esp + 0x9c], 0xc
mov byte [esp + 0x98], 0
call fcn.00447260
lea edx, [esp + 0xdc]
lea ecx, [esp + 0x848]
call fcn.004e9040
fldz
lea ecx, [esp + 0x10c]
push 0xa
push str.platformid
fstp qword [esp + 0x868]
mov byte [esp + 0x870], 0
mov dword [esp + 0x114], 0
mov dword [esp + 0x124], 0
mov dword [esp + 0x128], 0xf
call fcn.00449cf0
mov eax, dword [esp + 0xc78]
fild dword [esp + 0xc78]
test eax, eax
jns 0x43e945
fadd qword [0x5f4758]
lea eax, [esp + 0x10c]
push eax
lea ecx, [esp + 0x874]
fstp qword [esp + 0x14]
call fcn.00447260
fld qword [esp + 0x10]
lea ecx, [esp + 0xf4]
push 5
push str.suite
fstp qword [esp + 0x8a8]
mov dword [esp + 0x890], 0
mov dword [esp + 0x8a0], 0
mov dword [esp + 0x8a4], 0xf
mov byte [esp + 0x8b0], 0
mov dword [esp + 0xfc], 0
mov dword [esp + 0x10c], 0
mov dword [esp + 0x110], 0xf
call fcn.00449cf0
movzx eax, word [esp + 0xd80]
lea ecx, [esp + 0x8b0]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xf4]
fild dword [esp + 0x10]
push eax
fstp qword [esp + 0x14]
call fcn.00447260
fld qword [esp + 0x10]
lea ecx, [esp + 0x3b8]
push 4
push str.type
fstp qword [esp + 0x8e8]
mov dword [esp + 0x8d0], 0
mov dword [esp + 0x8e0], 0
mov dword [esp + 0x8e4], 0xf
mov byte [esp + 0x8f0], 0
mov dword [esp + 0x3c0], 0
mov dword [esp + 0x3d0], 0
mov dword [esp + 0x3d4], 0xf
call fcn.00449cf0
movzx eax, byte [esp + 0xd82]
lea ecx, [esp + 0x8f0]
mov dword [esp + 0x10], eax
sub esp, 8
fild dword [esp + 0x18]
lea eax, [esp + 0x3c0]
fstp qword [esp]
push eax
call fcn.004d2c00
lea ecx, [esp + 0x770]
push ecx
lea eax, [esp + 0x934]
push eax
push ecx
lea ecx, [esp + 0x2ec]
call fcn.004456c0
push 0x22
push str.Windows_____________
lea ecx, [esp + 0x3a8]
mov dword [esp + 0x3a8], 0
mov dword [esp + 0x3b8], 0
mov dword [esp + 0x3bc], 0xf
call fcn.00449cf0
push 7
push str.windows
lea ecx, [esp + 0x390]
mov dword [esp + 0x390], 0
mov dword [esp + 0x3a0], 0
mov dword [esp + 0x3a4], 0xf
call fcn.00449cf0
lea eax, [esp + 0x2e0]
mov ecx, 6
push eax
push 0x478
lea eax, [esp + 0x3a8]
push 0x5def08
push eax
lea edx, [esp + 0x398]
call fcn.004d4b60
add esp, 0x10
lea ecx, [esp + 0x388]
call fcn.004470b0
lea ecx, [esp + 0x3a0]
call fcn.004470b0
lea ecx, [esp + 0x2e0]
call fcn.00449240
push fcn.00438e00
push 7
push 0x40
lea eax, [esp + 0x77c]
push eax
call fcn.00583d37
lea ecx, [esp + 0x3b8]
call fcn.004470b0
mov ecx, dword [esp + 0x108]
cmp ecx, 0x10
jb 0x43ebb4
mov edx, dword [esp + 0xf4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43ebaa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43fef8
push ecx
push edx
call fcn.00583877
add esp, 8
mov ecx, dword [esp + 0x120]
mov dword [esp + 0x104], 0
mov dword [esp + 0x108], 0xf
mov byte [esp + 0xf4], 0
cmp ecx, 0x10
jb 0x43ec0e
mov edx, dword [esp + 0x10c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43ec04
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43fef8
push ecx
push edx
call fcn.00583877
add esp, 8
mov ecx, dword [esp + 0x9c]
mov dword [esp + 0x11c], 0
mov dword [esp + 0x120], 0xf
mov byte [esp + 0x10c], 0
cmp ecx, 0x10
jb 0x43ec68
mov edx, dword [esp + 0x88]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43ec5e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43fef8
push ecx
push edx
call fcn.00583877
add esp, 8
mov eax, dword [esp + 0xf0]
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0xf
mov byte [esp + 0x88], 0
cmp eax, 8
jb 0x43eca7
inc eax
lea ecx, [esp + 0xdc]
push eax
push dword [esp + 0xe0]
call fcn.00449ab0
mov ecx, dword [esp + 0x168]
xor eax, eax
mov dword [esp + 0xec], 0
mov dword [esp + 0xf0], 7
mov word [esp + 0xdc], ax
cmp ecx, 0x10
jb 0x43ed03
mov edx, dword [esp + 0x154]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43ecf9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43fef8
push ecx
push edx
call fcn.00583877
add esp, 8
mov ecx, dword [esp + 0x180]
mov dword [esp + 0x164], 0
mov dword [esp + 0x168], 0xf
mov byte [esp + 0x154], 0
cmp ecx, 0x10
jb 0x43ed5d
mov edx, dword [esp + 0x16c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43ed53
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43fef8
push ecx
push edx
call fcn.00583877
add esp, 8
mov ecx, dword [esp + 0x198]
mov dword [esp + 0x17c], 0
mov dword [esp + 0x180], 0xf
mov byte [esp + 0x16c], 0
cmp ecx, 0x10
jb 0x43edb7
mov edx, dword [esp + 0x184]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43edad
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43fef8
push ecx
push edx
call fcn.00583877
add esp, 8
mov dword [esp + 0x194], 0
mov dword [esp + 0x198], 0xf
mov byte [esp + 0x184], 0
call fcn.005201a0
lea ecx, [esp + 0x990]
push ecx
mov ecx, eax
call fcn.00438000
push 8
push 0x5de374
lea ecx, [esp + 0x408]
mov dword [esp + 0x408], 0
mov esi, eax
mov dword [esp + 0x418], 0
mov dword [esp + 0x41c], 0xf
call fcn.00449cf0
lea eax, [esp + 0x400]
push eax
lea ecx, [esp + 0x734]
call fcn.00447260
push esi
lea ecx, [esp + 0x74c]
call fcn.00447260
fldz
lea ecx, [esp + 0x730]
push ecx
lea eax, [esp + 0x774]
mov byte [esp + 0x76c], 0
push eax
push ecx
lea ecx, [esp + 0x2f8]
fstp qword [esp + 0x76c]
call fcn.004456c0
push 0xe
push str.Environment_
lea ecx, [esp + 0x3f0]
mov dword [esp + 0x3f0], 0
mov dword [esp + 0x400], 0
mov dword [esp + 0x404], 0xf
call fcn.00449cf0
push 3
push 0x5de390
lea ecx, [esp + 0x3d8]
mov dword [esp + 0x3d8], 0
mov dword [esp + 0x3e8], 0
mov dword [esp + 0x3ec], 0xf
call fcn.00449cf0
lea eax, [esp + 0x2ec]
xor ecx, ecx
push eax
push 0x479
lea eax, [esp + 0x3f0]
push 0x5def08
push eax
lea edx, [esp + 0x3e0]
call fcn.004d4b60
add esp, 0x10
lea ecx, [esp + 0x3d0]
call fcn.004470b0
lea ecx, [esp + 0x3e8]
call fcn.004470b0
lea ecx, [esp + 0x2ec]
call fcn.00449240
push fcn.00438e00
push 1
push 0x40
lea eax, [esp + 0x73c]
push eax
call fcn.00583d37
lea ecx, [esp + 0x400]
call fcn.004470b0
lea ecx, [esp + 0x990]
call fcn.004470b0
push 4
push str.mode
lea ecx, [esp + 0x294]
mov dword [esp + 0x294], 0
mov dword [esp + 0x2a4], 0
mov dword [esp + 0x2a8], 0xf
call fcn.00449cf0
lea eax, [esp + 0x28c]
push eax
lea ecx, [esp + 0x9ac]
call fcn.00447260
mov edx, 0x6acf04
lea ecx, [esp + 0x9c0]
call fcn.004e9040
fldz
mov eax, dword [0x6c54a0]
mov byte [esp + 0x9e0], 0
fstp qword [esp + 0x9d8]
fild dword [0x6c54a0]
test eax, eax
jns 0x43efd2
fadd qword [0x5f4758]
push 6
push str.sessid
lea ecx, [esp + 0x4e0]
mov dword [esp + 0x4e0], 0
fstp qword [esp + 0x18]
mov dword [esp + 0x4f0], 0
mov dword [esp + 0x4f4], 0xf
call fcn.00449cf0
fld qword [esp + 0x10]
lea eax, [esp + 0x4d8]
sub esp, 8
lea ecx, [esp + 0x9f0]
fstp qword [esp]
push eax
call fcn.004d2c00
push 8
push str.selected
lea ecx, [esp + 0x4c8]
mov dword [esp + 0x4c8], 0
mov dword [esp + 0x4d8], 0
mov dword [esp + 0x4dc], 0xf
call fcn.00449cf0
lea eax, [esp + 0x4c0]
push eax
lea ecx, [esp + 0xa2c]
call fcn.00447260
mov edx, 0x6acea4
lea ecx, [esp + 0xa40]
call fcn.004e9040
fldz
lea ecx, [esp + 0x4a8]
push 7
push str.restart
fstp qword [esp + 0xa60]
mov byte [esp + 0xa68], 0
mov dword [esp + 0x4b0], 0
mov dword [esp + 0x4c0], 0
mov dword [esp + 0x4c4], 0xf
call fcn.00449cf0
lea eax, [esp + 0x4a8]
push eax
lea ecx, [esp + 0xa6c]
call fcn.00447260
mov edx, 0x6acebc
lea ecx, [esp + 0xa80]
call fcn.004e9040
movzx eax, byte [0x6c54a4]
lea ecx, [esp + 0x490]
fldz
fstp qword [esp + 0xa98]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
push 7
push str.updated
mov byte [esp + 0xaa8], 0
mov dword [esp + 0x498], 0
fstp qword [esp + 0x18]
mov dword [esp + 0x4a8], 0
mov dword [esp + 0x4ac], 0xf
call fcn.00449cf0
lea eax, [esp + 0x490]
push eax
lea ecx, [esp + 0xaac]
call fcn.00447260
fld qword [esp + 0x10]
lea ecx, [esp + 0x478]
push 9
push str.boot_mode
fstp qword [esp + 0xae0]
mov dword [esp + 0xac8], 0
mov dword [esp + 0xad8], 0
mov dword [esp + 0xadc], 0xf
mov byte [esp + 0xae8], 0
mov dword [esp + 0x480], 0
mov dword [esp + 0x490], 0
mov dword [esp + 0x494], 0xf
call fcn.00449cf0
lea eax, [esp + 0x478]
push eax
lea ecx, [esp + 0xaec]
call fcn.00447260
fild dword [esp + 0x40]
mov dword [esp + 0xb00], 0
mov dword [esp + 0xb10], 0
mov dword [esp + 0xb14], 0xf
mov byte [esp + 0xb20], 0
fstp qword [esp + 0xb18]
call fcn.00456880
movzx eax, al
lea ecx, [esp + 0x460]
mov dword [esp + 0x40], eax
fild dword [esp + 0x40]
push 5
push str.admin
mov dword [esp + 0x468], 0
mov dword [esp + 0x478], 0
fstp qword [esp + 0x48]
mov dword [esp + 0x47c], 0xf
call fcn.00449cf0
lea eax, [esp + 0x460]
push eax
lea ecx, [esp + 0xb2c]
call fcn.00447260
movzx eax, byte [0x6c54cc]
lea ecx, [esp + 0x448]
fld qword [esp + 0x40]
fstp qword [esp + 0xb58]
mov dword [esp + 0x40], eax
fild dword [esp + 0x40]
push 7
push 0x5de3cc
mov dword [esp + 0xb48], 0
mov dword [esp + 0xb58], 0
fstp qword [esp + 0x48]
mov dword [esp + 0xb5c], 0xf
mov byte [esp + 0xb68], 0
mov dword [esp + 0x450], 0
mov dword [esp + 0x460], 0
mov dword [esp + 0x464], 0xf
call fcn.00449cf0
lea eax, [esp + 0x448]
push eax
lea ecx, [esp + 0xb6c]
call fcn.00447260
fld qword [esp + 0x40]
lea ecx, [esp + 0x9a8]
push ecx
lea eax, [esp + 0xbac]
mov dword [esp + 0xb84], 0
push eax
push ecx
lea ecx, [esp + 0x304]
mov dword [esp + 0xb9c], 0
fstp qword [esp + 0xba4]
mov dword [esp + 0xba0], 0xf
mov byte [esp + 0xbac], 0
call fcn.004456c0
push 0x3f
push str.Launch_parameters:_____________as___is_running_
lea ecx, [esp + 0x438]
mov dword [esp + 0x438], 0
mov dword [esp + 0x448], 0
mov dword [esp + 0x44c], 0xf
call fcn.00449cf0
push 6
push str.params
lea ecx, [esp + 0x420]
mov dword [esp + 0x420], 0
mov dword [esp + 0x430], 0
mov dword [esp + 0x434], 0xf
call fcn.00449cf0
lea eax, [esp + 0x2f8]
xor ecx, ecx
push eax
push 0x47c
lea eax, [esp + 0x438]
push 0x5def08
push eax
lea edx, [esp + 0x428]
call fcn.004d4b60
add esp, 0x10
lea ecx, [esp + 0x418]
call fcn.004470b0
lea ecx, [esp + 0x430]
call fcn.004470b0
lea ecx, [esp + 0x2f8]
call fcn.00449240
push fcn.00438e00
push 8
push 0x40
lea eax, [esp + 0x9b4]
push eax
call fcn.00583d37
lea ecx, [esp + 0x448]
call fcn.004470b0
lea ecx, [esp + 0x460]
call fcn.004470b0
lea ecx, [esp + 0x478]
call fcn.004470b0
lea ecx, [esp + 0x490]
call fcn.004470b0
lea ecx, [esp + 0x4a8]
call fcn.004470b0
lea ecx, [esp + 0x4c0]
call fcn.004470b0
lea ecx, [esp + 0x4d8]
call fcn.004470b0
lea ecx, [esp + 0x28c]
call fcn.004470b0
push 0x58
call fcn.005838a8
add esp, 4
mov ecx, 0x6acebc
cmp dword [0x6aced0], 8
cmovae ecx, dword [0x6acebc]
push ecx
mov ecx, eax
call fcn.00452ec0
push 8
mov dword [0x6c54c4], eax
call fcn.005838a8
mov ecx, eax
call fcn.0044d110
mov dword [0x6c54c0], eax
call fcn.00457ff0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test edi, edi
je 0x43f65d
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.Wow64DisableWow64FsRedirection
push edi
call esi
push str.Wow64RevertWow64FsRedirection
push edi
mov ebx, eax
call esi
mov esi, eax
test ebx, ebx
je 0x43f65d
test esi, esi
je 0x43f65d
lea eax, [esp + 0xb8]
push eax
call ebx
mov ebx, eax
mov dword [esp + 0x25c], 0
lea eax, [esp + 0x250]
mov dword [esp + 0x268], 0
push eax
mov dword [esp + 0x274], 0
mov dword [esp + 0x278], 0
mov dword [esp + 0x27c], 0
mov dword [esp + 0x280], 0
mov dword [esp + 0x284], 0
mov dword [esp + 0x288], 0
mov dword [esp + 0x28c], 0
mov dword [esp + 0x254], 0x3c
mov dword [esp + 0x264], str.bcdedit.exe
mov dword [esp + 0x268], str._deletevalue_safeboot
mov dword [esp + 0x25c], 0
mov dword [esp + 0x270], 1
mov dword [esp + 0x258], 0x8500
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x43f649
push str.Cant_run_BCDEdit_for_clearing_boot_mode
lea ecx, [esp + 0x6bc]
mov dword [esp + 0x134], eax
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], eax
call fcn.004471f0
push str.run_bcdedit
lea ecx, [esp + 0x6a4]
call fcn.004471f0
lea eax, [esp + 0x130]
mov ecx, 2
push eax
push 0x49d
lea eax, [esp + 0x6c0]
push 0x5def08
push eax
lea edx, [esp + 0x6b0]
call fcn.004d4b60
add esp, 0x10
lea ecx, [esp + 0x6a0]
call fcn.004470b0
lea ecx, [esp + 0x6b8]
call fcn.004470b0
lea ecx, [esp + 0x130]
call fcn.00449240
test ebx, ebx
je 0x43f656
push dword [esp + 0xb8]
call esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 2
mov dword [0x6c54b0], eax
mov dword [esp + 0x224], 0x30
mov dword [esp + 0x228], 3
mov dword [esp + 0x22c], 0x43b650
mov dword [esp + 0x230], 0
mov dword [esp + 0x234], 0
mov dword [esp + 0x238], eax
mov dword [esp + 0x23c], 0
mov dword [esp + 0x240], 0
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [esp + 0x240], eax
lea eax, [esp + 0x220]
push eax
mov dword [esp + 0x248], 0
mov dword [esp + 0x24c], str.AeroAdminTrayWnd
mov dword [esp + 0x250], 0
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push dword [0x6c54b0]
push 0
push 0
push 0
push 0
push 0
push 0
push closesocket
push str.AeroAdminTrayWnd
push str.AeroAdminTrayWnd
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x6c54d0], eax
test eax, eax
jne 0x43f84f
push 0x1d
push str.registering_tray_window_class
lea ecx, [esp + 0x2ac]
mov dword [esp + 0x144], eax
mov dword [esp + 0x148], eax
mov dword [esp + 0x14c], eax
mov dword [esp + 0x2ac], eax
mov dword [esp + 0x2bc], eax
mov dword [esp + 0x2c0], 0xf
call fcn.00449cf0
push 0x12
push str.reg_tray_wnd_class
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x1a4], 0
mov dword [esp + 0x1b4], 0
mov dword [esp + 0x1b8], 0xf
call fcn.00449cf0
lea eax, [esp + 0x13c]
mov ecx, 2
push eax
push 0x505
lea eax, [esp + 0x2ac]
push 0x5def08
push eax
lea edx, [esp + 0x1ac]
call fcn.004d4b60
mov ecx, dword [esp + 0x1c0]
add esp, 0x10
cmp ecx, 0x10
jb 0x43f819
mov edx, dword [esp + 0x19c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43f80f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43fefd
push ecx
push edx
call fcn.00583877
add esp, 8
lea ecx, [esp + 0x2a4]
mov dword [esp + 0x1ac], 0
mov dword [esp + 0x1b0], 0xf
mov byte [esp + 0x19c], 0
call fcn.004470b0
lea ecx, [esp + 0x13c]
call fcn.00449240
call fcn.00531180
mov esi, eax
call fcn.005201a0
lea ecx, [esp + 0x930]
push ecx
mov ecx, eax
call fcn.00438000
cmp dword [eax + 0x14], 0x10
jb 0x43f872
mov eax, dword [eax]
push eax
mov ecx, esi
call fcn.00531480
lea ecx, [esp + 0x930]
call fcn.004470b0
call fcn.00438270
mov ecx, eax
call fcn.0052fa80
cmp byte [0x6c54cc], 0
je 0x43f8be
mov esi, dword [0x6c5544]
test esi, esi
je 0x43f8be
push ecx
mov ecx, dword [esi + 0x50]
call fcn.0053cdf0
mov dword [eax + 0x30], 1
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_DrawMenuBar]
push 0x30c
lea eax, [esp + 0xe50]
push 0
push eax
call fcn.00585a40
add esp, 0xc
lea eax, [esp + 0x115c]
push 0x98
push 0
push eax
call fcn.00585a40
mov eax, dword [0x6c54d0]
add esp, 0xc
mov dword [esp + 0xe38], 0x3bc
mov dword [esp + 0x1158], 4
mov dword [esp + 0xe3c], eax
mov dword [esp + 0xe40], 1
mov dword [esp + 0xe44], 0x87
mov dword [esp + 0xe48], 0x8000
call fcn.00438270
mov esi, eax
call fcn.00531180
cmp dword [eax + 0x14], 0x10
jb 0x43f943
mov eax, dword [eax]
push str.tray_tip
push eax
mov ecx, esi
call fcn.0052fc30
lea edx, [esp + 0xe50]
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x43f960
push 0
push 0x10
push 0x10
push 1
push 0x7b
push dword [0x6c54b0]
call dword [sym.imp.USER32.dll_LoadImageW]
mov edi, dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [esp + 0xe4c], eax
lea eax, [esp + 0xe38]
push eax
push 0
call edi
lea eax, [esp + 0xe38]
push eax
push 4
call edi
call fcn.005201a0
push 0
add eax, 0x130
push eax
lea eax, [esp + 0x730]
push eax
call fcn.0044c810
mov al, byte [eax + 4]
test al, al
jne 0x43fa15
push 0x178
call fcn.005838a8
add esp, 4
mov ecx, eax
push 0x6aced4
push str.MainWindow
push 0
push dword [0x6c54b0]
call fcn.00490670
mov eax, dword [0x6c5544]
push 9
push dword [eax + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x6c5544]
push dword [eax + 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x43fb89
push 0x12
push str.Running_with_no_UI
lea ecx, [esp + 0x1d4]
mov dword [esp + 0x150], 0
mov dword [esp + 0x154], 0
mov dword [esp + 0x158], 0
mov dword [esp + 0x1d4], 0
mov dword [esp + 0x1e4], 0
mov dword [esp + 0x1e8], 0xf
call fcn.00449cf0
push 5
push str.no_ui
lea ecx, [esp + 0x1bc]
mov dword [esp + 0x1bc], 0
mov dword [esp + 0x1cc], 0
mov dword [esp + 0x1d0], 0xf
call fcn.00449cf0
lea eax, [esp + 0x148]
xor ecx, ecx
push eax
push 0x525
lea eax, [esp + 0x1d4]
push 0x5def08
push eax
lea edx, [esp + 0x1c4]
call fcn.004d4b60
mov ecx, dword [esp + 0x1d8]
add esp, 0x10
cmp ecx, 0x10
jb 0x43fb05
mov edx, dword [esp + 0x1b4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43fafb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43ff02
push ecx
push edx
call fcn.00583877
add esp, 8
mov ecx, dword [esp + 0x1e0]
mov dword [esp + 0x1c4], 0
mov dword [esp + 0x1c8], 0xf
mov byte [esp + 0x1b4], 0
cmp ecx, 0x10
jb 0x43fb5f
mov edx, dword [esp + 0x1cc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43fb55
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43ff02
push ecx
push edx
call fcn.00583877
add esp, 8
lea ecx, [esp + 0x148]
mov dword [esp + 0x1dc], 0
mov dword [esp + 0x1e0], 0xf
mov byte [esp + 0x1cc], 0
call fcn.00449240
call fcn.005201a0
push 0
add eax, 0x260
push eax
lea eax, [esp + 0x568]
push eax
call fcn.0044c810
mov al, byte [eax + 4]
test al, al
je 0x43fbd6
push 0xe0
call fcn.005838a8
mov ecx, dword [0x6c5544]
add esp, 4
test ecx, ecx
je 0x43fbc6
mov ecx, dword [ecx + 0x10]
jmp 0x43fbc8
xor ecx, ecx
push ecx
push dword [0x6c54b0]
mov ecx, eax
call fcn.0049d940
lea ecx, [esp + 0x720]
call fcn.00436910
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [0x6d2260], ecx
lea ecx, [esp + 0x718]
mov dword [0x6d2264], eax
call fcn.00436910
cmp byte [0x6d17a5], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [0x6d2258], ecx
mov dword [0x6d225c], eax
mov dword [esp + 0x6c], 0
jne 0x43fe29
lea eax, [esp + 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
push ecx
lea ecx, [esp + 0xd8c]
call fcn.00446140
mov edx, str.AeroadminLocalIPB
lea ecx, [esp + 0xd98]
call fcn.0044d180
push dword [esp + 0xbc]
mov ecx, eax
call fcn.004462d0
lea eax, [esp + 0x4f0]
push eax
lea ecx, [esp + 0xda4]
call fcn.004492b0
cmp dword [esp + 0x504], 8
lea eax, [esp + 0x4f0]
push 1
cmovae eax, dword [esp + 0x4f4]
lea ecx, [esp + 0x68]
push 1
push eax
call fcn.004586c0
lea ecx, [esp + 0x4f0]
mov dword [0x6d393c], eax
call fcn.00449550
cmp dword [0x6d393c], 0
jne 0x43fe1d
lea eax, [esp + 0x508]
push eax
lea ecx, [esp + 0xda4]
call fcn.004492b0
cmp dword [esp + 0x51c], 8
lea eax, [esp + 0x508]
push 1
cmovae eax, dword [esp + 0x50c]
lea ecx, [esp + 0x68]
push 0
push eax
call fcn.004586c0
lea ecx, [esp + 0x508]
mov dword [0x6d393c], eax
call fcn.00449550
cmp dword [0x6d393c], 0
jne 0x43fe1d
lea eax, [esp + 0x948]
push eax
lea ecx, [esp + 0xd8c]
call fcn.00446120
push str.channel
lea ecx, [esp + 0x704]
mov esi, eax
call fcn.004471f0
push esi
lea eax, [esp + 0x704]
push eax
lea ecx, [esp + 0xc30]
call fcn.004d2ca0
lea ecx, [esp + 0xc28]
push ecx
lea eax, [esp + 0xc6c]
push eax
push ecx
lea ecx, [esp + 0x310]
call fcn.004456c0
push str.Cant_create_interprocess_communication_
lea ecx, [esp + 0x6ec]
call fcn.004471f0
push str.create_ipc
lea ecx, [esp + 0x6d4]
call fcn.004471f0
lea eax, [esp + 0x304]
mov ecx, 2
push eax
push 0x547
lea eax, [esp + 0x6f0]
push 0x5def08
push eax
lea edx, [esp + 0x6e0]
call fcn.004d4b60
add esp, 0x10
lea ecx, [esp + 0x6d0]
call fcn.004470b0
lea ecx, [esp + 0x6e8]
call fcn.004470b0
lea ecx, [esp + 0x304]
call fcn.00449240
push fcn.00438e00
push 1
push 0x40
lea eax, [esp + 0xc34]
push eax
call fcn.00583d37
lea ecx, [esp + 0x700]
call fcn.004470b0
lea ecx, [esp + 0x948]
call fcn.00449550
lea ecx, [esp + 0xd88]
call fcn.0043b280
call fcn.00440590
mov ecx, dword [0x6d23bc]
mov byte [0x6c5540], 1
test ecx, ecx
je 0x43fe62
call fcn.004369e0
mov eax, dword [0x6d23bc]
test eax, eax
je 0x43fe62
cmp dword [eax + 4], 0
jne 0x43ff07
push 8
push eax
call fcn.00583877
add esp, 8
cmp byte [0x6c54cd], 0
jne 0x43feb0
push 0x3b0
lea eax, [esp + 0x1208]
push 0
push eax
call fcn.00585a40
mov eax, dword [0x6c54d0]
add esp, 0xc
mov dword [esp + 0x11fc], eax
lea eax, [esp + 0x11f8]
mov dword [esp + 0x11f8], 0x3bc
mov dword [esp + 0x1200], 1
push eax
push 2
call edi
cmp dword [0x6c54c4], 0
je 0x43febe
call fcn.00438e90
mov eax, dword [esp + 0x68]
test eax, eax
je 0x43fed7
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xc0]
call fcn.004445f0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.00591c98
call fcn.00591c98
call fcn.00591c98
call fcn.00591c98
call fcn.00591c98
call fcn.00591a51
int3