Function at 0x42fe49
Capabilities:
Contain obfuscated stackstrings
Delete file
Delete registry key
Get common file path
Get file size
Move file
Parse pe header
Read file on windows
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x268bc]
mov eax, 0x268bc
call fcn.0043de00
push 0xffffffffffffffff
push 0x4c555f
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x509690]
xor eax, ebp
mov dword [ebp + 0x268b8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
call fcn.0040d24f
mov ecx, eax
call fcn.0040aaed
push eax
lea ecx, [ebp + 0x26598]
call fcn.004015a0
xor edi, edi
push 0x4e31b4
lea ecx, [ebp + 0x26598]
mov dword [ebp - 4], edi
call fcn.00403470
lea eax, [ebp + 0x26598]
push eax
lea ecx, [ebp + 0x265ec]
call fcn.00403330
lea eax, [ebp + 0x26598]
push eax
lea ecx, [ebp + 0x264b8]
mov byte [ebp - 4], 1
call fcn.00403330
push str.Slation.exe
lea ecx, [ebp + 0x264b8]
mov byte [ebp - 4], 2
call fcn.00403470
push 0x206
lea eax, [ebp + 0x266b2]
push edi
push eax
mov word [ebp + 0x266b0], di
call fcn.0043db80
lea eax, [ebp + 0x26598]
push eax
lea eax, [ebp + 0x26560]
push eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x6c], edi
call fcn.0041ec02
add esp, 0x14
push str.Temp.xml
lea ecx, [ebp + 0x26560]
mov byte [ebp - 4], 3
call fcn.0040b042
lea eax, [ebp + 0x26560]
push eax
lea eax, [ebp + 0x265b4]
push eax
call fcn.0041f2d4
pop ecx
pop ecx
cmp dword [ebp + 0x265cc], 8
mov eax, dword [ebp + 0x265b8]
mov byte [ebp - 4], 4
jae 0x42ff6c
lea eax, [ebp + 0x265b8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0x26598]
push eax
lea eax, [ebp + 0x2649c]
push eax
call fcn.0041ec02
pop ecx
pop ecx
push str.Config.xml
lea ecx, [ebp + 0x2649c]
mov byte [ebp - 4], 5
call fcn.0040b042
lea eax, [ebp + 0x26598]
push eax
lea eax, [ebp + 0x264d4]
push eax
call fcn.0041ec02
pop ecx
pop ecx
push str.temp.dat
lea ecx, [ebp + 0x264d4]
mov byte [ebp - 4], 6
call fcn.0040b042
lea ecx, [ebp - 0x278]
call fcn.0045eee0
push 0x38
mov byte [ebp - 4], 7
call fcn.00433c21
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, edi
mov byte [ebp - 4], 8
je 0x42ffff
push 0x4e31b0
push 0x4cff04
push 0x4cff00
mov ecx, eax
call fcn.0045f310
jmp 0x430001
xor eax, eax
push eax
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 7
call fcn.0045e430
push 0x50
call fcn.00433c21
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, edi
mov byte [ebp - 4], 9
je 0x430035
push str.TheQueryInfo
mov ecx, eax
call fcn.0045f7f0
mov dword [ebp - 0x38], eax
jmp 0x430038
mov dword [ebp - 0x38], edi
push 0x50
mov byte [ebp - 4], 7
call fcn.00433c21
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, edi
mov byte [ebp - 4], 0xa
je 0x430060
push str.PushList
mov ecx, eax
call fcn.0045f7f0
mov dword [ebp - 0x24], eax
jmp 0x430063
mov dword [ebp - 0x24], edi
push str.anV6aWJyb3dzZQ
lea ecx, [ebp + 0x26544]
mov byte [ebp - 4], 7
call fcn.004015a0
sub esp, 0x1c
lea eax, [ebp + 0x26544]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
mov byte [ebp - 4], 0xb
call fcn.00403330
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp + 0x264f0]
push eax
call fcn.0042fc00
push str.aGFvMTIza2FudHU
lea ecx, [ebp + 0x26544]
mov byte [ebp - 4], 0xc
call fcn.00403360
sub esp, 0x1c
lea eax, [ebp + 0x26544]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00403330
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp + 0x26528]
push eax
call fcn.0042fc00
mov esi, dword [ebp + 0x268c4]
mov eax, dword [esi + 8]
add esi, 4
push esi
push eax
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x1c], esi
call fcn.0040e876
mov eax, dword [esi + 8]
push esi
jmp 0x431a13
lea ecx, [ebp - 0x9c]
call fcn.0040e1fb
mov ebx, dword [eax + 0x1c]
push str.PushName
lea ecx, [ebp + 0x265d0]
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp + 0x265d0]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0xe
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x265d0]
mov byte [ebp - 4], 0xd
call fcn.00401770
push str.ChooseInstall
lea ecx, [ebp + 0x265d0]
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp + 0x265d0]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0xf
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x265d0]
mov esi, eax
mov byte [ebp - 4], 0xd
call fcn.00401770
cmp esi, edi
je 0x431a01
cmp dword [esi + 0x18], 8
jb 0x430189
mov esi, dword [esi + 4]
jmp 0x43018c
add esi, 4
push 0x4ca850
push esi
call fcn.0043ed1a
test eax, eax
pop ecx
pop ecx
jne 0x431a01
push str.PushName
lea ecx, [ebp + 0x265d0]
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp + 0x265d0]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x10
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x265d0]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0xd
call fcn.00401770
push str.PushKeyName
lea ecx, [ebp - 0x1dc]
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp - 0x1dc]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x11
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x1dc]
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 0xd
call fcn.00401770
push str.InstallPushUrl
lea ecx, [ebp + 0x26624]
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp + 0x26624]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x12
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x26624]
mov esi, eax
mov byte [ebp - 4], 0xd
call fcn.00401770
push str.InstallPush32Url
lea ecx, [ebp + 0x26678]
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp + 0x26678]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x13
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x26678]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0xd
call fcn.00401770
push str.InstallPush64Url
lea ecx, [ebp + 0x2665c]
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp + 0x2665c]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x14
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x2665c]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xd
call fcn.00401770
push str.InstallProgramName
lea ecx, [ebp - 0x1f8]
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp - 0x1f8]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x15
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0xc0], eax
mov byte [ebp - 4], 0xd
call fcn.00401770
push str.InstallAppDataName
lea ecx, [ebp - 0x134]
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp - 0x134]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x16
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x134]
mov dword [ebp - 0xc8], eax
mov byte [ebp - 4], 0xd
call fcn.00401770
push str.InstallGreenBag
lea ecx, [ebp + 0x26694]
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp + 0x26694]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x17
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x26694]
mov dword [ebp - 0xac], eax
mov byte [ebp - 4], 0xd
call fcn.00401770
push str.InstallRunParam
lea ecx, [ebp - 0x1a4]
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp - 0x1a4]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x18
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x1a4]
mov dword [ebp - 0x78], eax
mov byte [ebp - 4], 0xd
call fcn.00401770
push str.InstallRunExe
lea ecx, [ebp - 0x214]
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp - 0x214]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x19
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x214]
mov dword [ebp - 0xb8], eax
mov byte [ebp - 4], 0xd
call fcn.00401770
push str.InstallRunDll
lea ecx, [ebp - 0x188]
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp - 0x188]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1a
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x188]
mov dword [ebp - 0xc4], eax
mov byte [ebp - 4], 0xd
call fcn.00401770
push str.InstallRunDllFnName
lea ecx, [ebp - 0x1c0]
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp - 0x1c0]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1b
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 0xd
call fcn.00401770
push str.InstallTempName
lea ecx, [ebp - 0xf4]
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp - 0xf4]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1c
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 4], 0xd
call fcn.00401770
push str.InstallRunAdmin
lea ecx, [ebp - 0x230]
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp - 0x230]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1d
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 0xd
call fcn.00401770
push str.InstallRunLocalExe
lea ecx, [ebp - 0x16c]
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp - 0x16c]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1e
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0xa8], eax
mov byte [ebp - 4], 0xd
call fcn.00401770
push str.InstallType
lea ecx, [ebp - 0x150]
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp - 0x150]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1f
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x74], eax
mov byte [ebp - 4], 0xd
call fcn.00401770
push str.InstallUACType
lea ecx, [ebp - 0x94]
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp - 0x94]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x20
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0xd
call fcn.00401770
push str.InstallWmiMode
lea ecx, [ebp - 0x58]
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp - 0x58]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x21
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x58]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0xd
call fcn.00401770
lea ecx, [ebp - 0x118]
call fcn.0040deaa
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x22
call fcn.0040de62
test eax, eax
je 0x4305b5
cmp dword [ebp - 0x14], edi
je 0x4305bd
mov esi, dword [ebp - 0x14]
jmp 0x4305bd
cmp dword [ebp - 0x10], edi
je 0x4305bd
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
cmp eax, edi
je 0x43088a
cmp dword [eax + 0x18], 8
jb 0x4305d8
add eax, 4
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
jmp 0x4305de
add eax, 4
mov dword [ebp - 0x10], eax
push str.zmbd
push eax
call fcn.0043ed1a
test eax, eax
pop ecx
pop ecx
jne 0x4307e0
cmp dword [esi + 0x18], 8
jb 0x4305fe
mov esi, dword [esi + 4]
jmp 0x430601
add esi, 4
push esi
lea ecx, [ebp + 0x26694]
call fcn.004015a0
mov eax, dword [ebp + 0x26698]
push 8
pop esi
cmp dword [ebp + 0x266ac], esi
mov byte [ebp - 4], 0x23
jae 0x430628
lea eax, [ebp + 0x26698]
lea ecx, [ebp + 0x266b0]
push ecx
push eax
call fcn.0041dc47
pop ecx
pop ecx
lea eax, [ebp + 0x265ec]
push eax
lea ecx, [ebp + 0x26640]
call fcn.00403330
lea eax, [ebp + 0x266b0]
push eax
lea ecx, [ebp + 0x26640]
mov byte [ebp - 4], 0x24
call fcn.00403470
cmp dword [ebp + 0x26658], esi
mov eax, dword [ebp + 0x26644]
jae 0x430673
lea eax, [ebp + 0x26644]
push eax
call fcn.0041ef3a
pop ecx
lea ecx, [ebp - 0xd8]
call fcn.00401380
cmp dword [ebp + 0x26604], esi
mov eax, dword [ebp + 0x265f0]
mov byte [ebp - 4], 0x25
jae 0x43069d
lea eax, [ebp + 0x265f0]
push eax
lea ecx, [ebp - 0x94]
call fcn.004015a0
cmp dword [ebp + 0x266ac], esi
mov eax, dword [ebp + 0x26698]
mov byte [ebp - 4], 0x26
jae 0x4306c1
lea eax, [ebp + 0x26698]
push eax
lea ecx, [ebp - 0x58]
call fcn.004015a0
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x27
call fcn.00401420
movzx eax, al
xor esi, esi
push edi
inc esi
push esi
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x14], eax
call fcn.00401770
push edi
push esi
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x25
call fcn.00401770
cmp dword [ebp - 0x14], edi
lea ecx, [ebp - 0x94]
je 0x430734
push 0x4ca850
call fcn.004015a0
push str.DownloadFlag
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x28
call fcn.004015a0
mov byte [ebp - 4], 0x29
jmp 0x430753
push 0x4ca828
call fcn.004015a0
push str.DownloadFlag
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x2a
call fcn.004015a0
mov byte [ebp - 4], 0x2b
mov eax, dword [ebx]
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, ebx
call dword [eax + 8]
push edi
push esi
lea ecx, [ebp - 0x58]
call fcn.00401770
push edi
push esi
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x25
call fcn.00401770
cmp dword [ebp - 0x14], edi
je 0x4307b7
cmp dword [ebp + 0x26658], 8
mov eax, dword [ebp + 0x26644]
jae 0x43079a
lea eax, [ebp + 0x26644]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, edi
je 0x4307b7
push str.DownloaderHelper
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x4307b7
call eax
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x24
call fcn.00401410
push edi
push esi
lea ecx, [ebp + 0x26640]
call fcn.00401770
push edi
push esi
lea ecx, [ebp + 0x26694]
jmp 0x4319ed
cmp dword [ebp + 0x26540], 8
mov ecx, dword [ebp + 0x2652c]
jae 0x4307f5
lea ecx, [ebp + 0x2652c]
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x18], 8
mov eax, dword [ebp - 0x10]
jb 0x430803
mov eax, dword [eax]
push ecx
push eax
call fcn.0043ed1a
test eax, eax
pop ecx
pop ecx
jne 0x430856
cmp esi, edi
je 0x4319f2
lea ecx, [ebp + 0x26130]
call fcn.00432fe8
cmp dword [esi + 0x18], 8
mov byte [ebp - 4], 0x2c
jb 0x430832
mov esi, dword [esi + 4]
jmp 0x430835
add esi, 4
push esi
push ebx
lea ecx, [ebp + 0x26130]
call fcn.0043370c
lea ecx, [ebp + 0x26130]
mov byte [ebp - 4], 0x22
call fcn.00432e6c
jmp 0x4319f2
cmp dword [ebp + 0x26508], 8
mov ecx, dword [ebp + 0x264f4]
jae 0x43086b
lea ecx, [ebp + 0x264f4]
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x18], 8
mov eax, dword [ebp - 0x10]
jb 0x430879
mov eax, dword [eax]
push ecx
push eax
call fcn.0043ed1a
test eax, eax
pop ecx
pop ecx
je 0x4319f2
cmp esi, edi
je 0x4319f2
cmp dword [esi + 0x18], 8
mov dword [ebp - 0x64], 1
jb 0x4308a4
mov esi, dword [esi + 4]
jmp 0x4308a7
add esi, 4
push esi
lea ecx, [ebp + 0x26640]
call fcn.004015a0
mov eax, dword [ebp + 0x26644]
push 8
pop esi
cmp dword [ebp + 0x26658], esi
mov byte [ebp - 4], 0x2d
jae 0x4308ce
lea eax, [ebp + 0x26644]
lea ecx, [ebp + 0x266b0]
push ecx
push eax
call fcn.0041dc47
pop ecx
pop ecx
lea eax, [ebp + 0x265ec]
push eax
lea ecx, [ebp + 0x26608]
call fcn.00403330
lea eax, [ebp + 0x266b0]
push eax
lea ecx, [ebp + 0x26608]
mov byte [ebp - 4], 0x2e
call fcn.00403470
cmp dword [ebp + 0x26620], esi
mov eax, dword [ebp + 0x2660c]
jae 0x430919
lea eax, [ebp + 0x2660c]
push eax
call fcn.0041ef3a
pop ecx
lea ecx, [ebp - 0xd0]
call fcn.00401380
cmp dword [ebp + 0x26604], esi
mov eax, dword [ebp + 0x265f0]
mov byte [ebp - 4], 0x2f
jae 0x430943
lea eax, [ebp + 0x265f0]
push eax
lea ecx, [ebp + 0x26678]
call fcn.004015a0
cmp dword [ebp + 0x26658], esi
mov eax, dword [ebp + 0x26644]
mov byte [ebp - 4], 0x30
jae 0x430967
lea eax, [ebp + 0x26644]
push eax
lea ecx, [ebp + 0x26624]
call fcn.004015a0
lea eax, [ebp + 0x26678]
push eax
lea eax, [ebp + 0x26624]
push eax
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x31
call fcn.00401420
movzx eax, al
xor esi, esi
push edi
inc esi
push esi
lea ecx, [ebp + 0x26624]
mov dword [ebp - 0x10], eax
call fcn.00401770
push edi
push esi
lea ecx, [ebp + 0x26678]
mov byte [ebp - 4], 0x2f
call fcn.00401770
cmp dword [ebp - 0x10], edi
jne 0x430af9
lea eax, [ebp + 0x26640]
push eax
lea eax, [ebp + 0x26624]
push eax
mov dword [ebp - 0x10], esi
call fcn.0041ec02
cmp dword [eax + 0x18], 0x10
pop ecx
pop ecx
jb 0x4309e3
mov eax, dword [eax + 4]
jmp 0x4309e6
add eax, 4
push eax
lea eax, [ebp + 0x25e30]
push eax
call fcn.0043ee40
pop ecx
pop ecx
push edi
push esi
lea ecx, [ebp + 0x26624]
call fcn.00401720
lea eax, [ebp + 0x265ec]
push eax
lea eax, [ebp + 0x26624]
push eax
call fcn.0041ec02
cmp dword [eax + 0x18], 0x10
pop ecx
pop ecx
jb 0x430a22
mov eax, dword [eax + 4]
jmp 0x430a25
add eax, 4
push eax
lea eax, [ebp + 0x26030]
push eax
call fcn.0043ee40
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp + 0x26624]
call fcn.00401720
lea ecx, [ebp]
call fcn.00427b9e
sub esp, 0x300
mov edi, esp
mov ecx, 0xc0
lea esi, [ebp + 0x25e30]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp]
mov byte [ebp - 4], 0x32
call fcn.00428466
lea ecx, [ebp]
call fcn.004281ae
lea ecx, [ebp + 0x26184]
call fcn.00427b5f
lea ecx, [ebp]
call fcn.00427bfc
test eax, eax
je 0x430aa2
lea eax, [ebp + 0x26184]
push eax
lea ecx, [ebp]
call fcn.004280a7
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp]
call fcn.00427c08
test eax, eax
je 0x430a7f
lea eax, [ebp + 0x26184]
push eax
lea ecx, [ebp]
call fcn.004280a7
fld qword [ebp + 0x2648c]
fcomp qword [ebp + 0x26494]
fnstsw ax
test ah, 0x44
jp 0x430adf
fldz
fcomp qword [ebp + 0x26494]
fnstsw ax
test ah, 0x44
jp 0x430ae3
and dword [ebp - 0x10], 0
lea ecx, [ebp]
mov byte [ebp - 4], 0x2f
call fcn.00427bf7
cmp dword [ebp - 0x10], 0
je 0x430bb7
push 0x4ca850
lea ecx, [ebp + 0x26678]
call fcn.004015a0
push str.DownloadFlag
lea ecx, [ebp + 0x26624]
mov byte [ebp - 4], 0x33
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp + 0x26678]
push ecx
lea ecx, [ebp + 0x26624]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x34
call dword [eax + 8]
xor edi, edi
push edi
push 1
lea ecx, [ebp + 0x26624]
call fcn.00401770
push edi
push 1
lea ecx, [ebp + 0x26678]
mov byte [ebp - 4], 0x2f
call fcn.00401770
mov eax, dword [ebp - 0x20]
push 8
pop esi
cmp dword [eax + 0x18], esi
jb 0x430b68
mov eax, dword [eax + 4]
jmp 0x430b6b
add eax, 4
push str.alimama
push eax
call fcn.0043ed1a
test eax, eax
pop ecx
pop ecx
jne 0x430c1b
lea eax, [ebp - 0x68]
push eax
push 0xf003f
push edi
push str.Software
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x430c1b
push str.AlimamaShortcuts
push dword [ebp - 0x68]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x430c1b
push 0x4ca828
lea ecx, [ebp + 0x26624]
call fcn.004015a0
push str.DownloadFlag
lea ecx, [ebp + 0x265d0]
mov byte [ebp - 4], 0x35
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp + 0x26624]
push ecx
lea ecx, [ebp + 0x265d0]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x36
call dword [eax + 8]
push 0
push 1
lea ecx, [ebp + 0x265d0]
call fcn.00401770
push 0
push 1
lea ecx, [ebp + 0x26624]
mov byte [ebp - 4], 0x2f
call fcn.00401770
push 8
xor edi, edi
pop esi
cmp dword [ebp + 0x26604], esi
mov ecx, dword [ebp + 0x265f0]
jae 0x430c2f
lea ecx, [ebp + 0x265f0]
cmp dword [ebp + 0x26658], esi
mov eax, dword [ebp + 0x26644]
jae 0x430c43
lea eax, [ebp + 0x26644]
push dword [ebp - 0x10]
push ecx
push eax
push str.__s___s___d_
call fcn.004205cc
add esp, 0x10
cmp dword [ebp - 0x10], edi
je 0x4319c7
cmp dword [ebp + 0x26604], esi
mov eax, dword [ebp + 0x265f0]
jae 0x430c72
lea eax, [ebp + 0x265f0]
push eax
lea ecx, [ebp + 0x2665c]
call fcn.004015a0
lea eax, [ebp + 0x266b0]
push eax
lea ecx, [ebp + 0x26624]
mov byte [ebp - 4], 0x37
call fcn.004015a0
mov eax, dword [ebp - 0xac]
cmp eax, edi
mov byte [ebp - 4], 0x38
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
je 0x430ee4
cmp dword [eax + 0x18], esi
jb 0x430cb6
mov eax, dword [eax + 4]
jmp 0x430cb9
add eax, 4
push 0x4ca850
push eax
call fcn.0043ed1a
test eax, eax
pop ecx
pop ecx
jne 0x430ee4
push 0x4e31d4
lea ecx, [ebp + 0x26694]
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x64], edi
call fcn.004015a0
mov esi, dword [ebp - 0xc0]
cmp esi, edi
mov byte [ebp - 4], 0x39
je 0x430d17
push 0x206
lea eax, [ebp + 0x26296]
push edi
push eax
mov word [ebp + 0x26294], di
call fcn.0043db80
add esp, 0xc
push edi
push 0x26
jmp 0x430d40
mov esi, dword [ebp - 0xc8]
cmp esi, edi
je 0x430d72
push 0x206
lea eax, [ebp + 0x26296]
push edi
push eax
mov word [ebp + 0x26294], di
call fcn.0043db80
add esp, 0xc
push edi
push 0x1a
lea eax, [ebp + 0x26294]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp + 0x26294]
push eax
lea ecx, [ebp + 0x26694]
call fcn.00403360
push 0x4e31b4
lea ecx, [ebp + 0x26694]
call fcn.00403470
jmp 0x430dbc
mov esi, dword [ebp - 0xbc]
cmp esi, edi
je 0x430de8
push 0x206
lea eax, [ebp + 0x26296]
push edi
push eax
mov word [ebp + 0x26294], di
call fcn.0043db80
add esp, 0xc
lea eax, [ebp + 0x26294]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp + 0x26294]
push eax
lea ecx, [ebp + 0x26694]
call fcn.00403360
cmp dword [esi + 0x18], 8
jb 0x430dc7
mov esi, dword [esi + 4]
jmp 0x430dca
add esi, 4
push esi
lea ecx, [ebp + 0x26694]
call fcn.00403470
push 0x4e31b4
lea ecx, [ebp + 0x26694]
call fcn.00403470
jmp 0x430e00
call fcn.0040d24f
mov ecx, eax
call fcn.0040b08c
push eax
lea ecx, [ebp + 0x26694]
call fcn.00403360
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26694]
push eax
lea ecx, [ebp + 0x2665c]
call fcn.00401ce0
cmp dword [ebp + 0x26604], 8
mov eax, dword [ebp + 0x265f0]
jae 0x430e2a
lea eax, [ebp + 0x265f0]
push eax
lea ecx, [ebp + 0x26678]
call fcn.004015a0
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26624]
push eax
lea ecx, [ebp + 0x26678]
mov byte [ebp - 4], 0x3a
call fcn.004038f0
lea eax, [ebp + 0x26678]
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.0041ec02
pop ecx
pop ecx
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0x3b
jb 0x430e73
mov eax, dword [eax + 4]
jmp 0x430e76
add eax, 4
cmp dword [ebp + 0x266ac], 8
mov ecx, dword [ebp + 0x26698]
jae 0x430e8b
lea ecx, [ebp + 0x26698]
push edi
push edi
push eax
push ecx
call fcn.0040962b
add esp, 0x10
push edi
push 1
lea ecx, [ebp - 0xf4]
call fcn.00401720
cmp dword [ebp + 0x26690], 8
mov eax, dword [ebp + 0x2667c]
jae 0x430eba
lea eax, [ebp + 0x2667c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push 1
lea ecx, [ebp + 0x26678]
call fcn.00401770
push edi
push 1
lea ecx, [ebp + 0x26694]
mov byte [ebp - 4], 0x38
call fcn.00401770
push 8
pop esi
mov eax, dword [ebp - 0xb8]
cmp eax, edi
je 0x430fb1
cmp dword [eax + 0x18], esi
jb 0x430efc
mov eax, dword [eax + 4]
jmp 0x430eff
add eax, 4
push eax
lea ecx, [ebp + 0x26624]
call fcn.00403360
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26624]
push eax
lea ecx, [ebp + 0x2665c]
call fcn.004038f0
cmp dword [ebp - 0x14], edi
jne 0x431329
cmp dword [ebp + 0x26674], esi
mov ecx, dword [ebp + 0x26660]
jae 0x430f3d
lea ecx, [ebp + 0x26660]
cmp dword [ebp + 0x26620], esi
mov eax, dword [ebp + 0x2660c]
jae 0x430f51
lea eax, [ebp + 0x2660c]
push ecx
push eax
call fcn.0041dd67
cmp dword [ebp + 0x26674], esi
pop ecx
pop ecx
mov ecx, dword [ebp + 0x26660]
jae 0x430f6e
lea ecx, [ebp + 0x26660]
cmp dword [ebp + 0x26620], esi
mov eax, dword [ebp + 0x2660c]
jae 0x430f82
lea eax, [ebp + 0x2660c]
push ecx
push eax
push str.__s___s_
call fcn.004205cc
mov eax, dword [ebp + 0x2660c]
add esp, 0xc
cmp dword [ebp + 0x26620], esi
jae 0x430fa5
lea eax, [ebp + 0x2660c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x431329
mov eax, dword [ebp - 0xc4]
cmp eax, edi
je 0x431317
cmp dword [eax + 0x18], esi
mov dword [ebp - 0x10], 1
jb 0x430fd0
mov eax, dword [eax + 4]
jmp 0x430fd3
add eax, 4
push eax
lea ecx, [ebp + 0x26624]
call fcn.00403360
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26624]
push eax
lea ecx, [ebp + 0x2665c]
call fcn.004038f0
cmp dword [ebp - 0x14], edi
jne 0x431080
cmp dword [ebp + 0x26674], esi
mov ecx, dword [ebp + 0x26660]
jae 0x431011
lea ecx, [ebp + 0x26660]
cmp dword [ebp + 0x26620], esi
mov eax, dword [ebp + 0x2660c]
jae 0x431025
lea eax, [ebp + 0x2660c]
push ecx
push eax
call fcn.0041dd67
cmp dword [ebp + 0x26674], esi
pop ecx
pop ecx
mov ecx, dword [ebp + 0x26660]
jae 0x431042
lea ecx, [ebp + 0x26660]
cmp dword [ebp + 0x26620], esi
mov eax, dword [ebp + 0x2660c]
jae 0x431056
lea eax, [ebp + 0x2660c]
push ecx
push eax
push str.__s___s_
call fcn.004205cc
mov eax, dword [ebp + 0x2660c]
add esp, 0xc
cmp dword [ebp + 0x26620], esi
jae 0x431079
lea eax, [ebp + 0x2660c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x74]
cmp eax, edi
je 0x4310ac
cmp dword [eax + 0x18], esi
jb 0x431091
mov eax, dword [eax + 4]
jmp 0x431094
add eax, 4
push 0x4cfc48
push eax
call fcn.0043ed1a
test eax, eax
pop ecx
pop ecx
jne 0x4310ac
mov dword [ebp - 0x30], 1
lea eax, [ebp + 0x2665c]
push eax
lea ecx, [ebp + 0x265d0]
call fcn.00403330
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp + 0x26678]
push eax
mov byte [ebp - 4], 0x3c
call fcn.0042fd5b
push 0x4e31d4
lea ecx, [ebp + 0x26694]
mov byte [ebp - 4], 0x3d
call fcn.004015a0
mov esi, dword [ebp - 0x2c]
push 0xffffffffffffffff
lea eax, [ebp + 0x265d0]
push edi
lea ecx, [ebp + 0x26694]
push eax
mov byte [ebp - 4], 0x3e
call fcn.00401ce0
cmp esi, edi
je 0x43112f
push 0x4cfc44
lea ecx, [ebp + 0x26694]
call fcn.00403470
cmp dword [esi + 0x18], 8
jb 0x431120
mov esi, dword [esi + 4]
jmp 0x431123
add esi, 4
push esi
lea ecx, [ebp + 0x26694]
call fcn.00403470
cmp dword [ebp + 0x266ac], 8
mov ecx, dword [ebp + 0x26698]
jae 0x431144
lea ecx, [ebp + 0x26698]
cmp dword [ebp + 0x26690], 8
mov eax, dword [ebp + 0x2667c]
jae 0x431159
lea eax, [ebp + 0x2667c]
push ecx
push eax
lea eax, [ebp + 0x25f28]
push 0x4ca648
push eax
call fcn.0043ec84
add esp, 0x10
cmp dword [ebp - 0x30], edi
je 0x4312da
push 0x50
call fcn.00433c21
pop ecx
mov dword [ebp - 0x2c], eax
cmp eax, edi
mov byte [ebp - 4], 0x3f
je 0x43119c
push str.PushItem
mov ecx, eax
call fcn.0045f7f0
mov dword [ebp - 0x20], eax
jmp 0x43119f
mov dword [ebp - 0x20], edi
push 0x50
mov byte [ebp - 4], 0x3e
call fcn.00433c21
pop ecx
mov dword [ebp - 0x2c], eax
cmp eax, edi
mov byte [ebp - 4], 0x40
je 0x4311c6
push 0x4cfc28
mov ecx, eax
call fcn.0045f7f0
mov esi, eax
jmp 0x4311c8
xor esi, esi
push 0x1f3
lea eax, [ebp + 0x262a9]
push edi
push eax
mov byte [ebp - 4], 0x3e
mov byte [ebp + 0x262a8], 0
call fcn.0043db80
mov eax, dword [ebp + 0x2667c]
add esp, 0xc
cmp dword [ebp + 0x26690], 8
jae 0x4311fd
lea eax, [ebp + 0x2667c]
lea ecx, [ebp + 0x262a8]
push ecx
push eax
call fcn.0041d42e
push 0x30
call fcn.00433c21
add esp, 0xc
mov dword [ebp - 0x2c], eax
cmp eax, edi
mov byte [ebp - 4], 0x41
je 0x43122f
lea ecx, [ebp + 0x262a8]
push ecx
mov ecx, eax
call fcn.0042ec8b
jmp 0x431231
xor eax, eax
push eax
mov ecx, esi
mov byte [ebp - 4], 0x3e
call fcn.0045e430
mov ecx, dword [ebp - 0x20]
push esi
call fcn.0045e430
push 0x50
call fcn.00433c21
pop ecx
mov dword [ebp - 0x2c], eax
cmp eax, edi
mov byte [ebp - 4], 0x42
je 0x431269
push 0x4cfc18
mov ecx, eax
call fcn.0045f7f0
mov esi, eax
jmp 0x43126b
xor esi, esi
cmp dword [ebp + 0x266ac], 8
mov eax, dword [ebp + 0x26698]
mov byte [ebp - 4], 0x3e
jae 0x431284
lea eax, [ebp + 0x26698]
lea ecx, [ebp + 0x262a8]
push ecx
push eax
call fcn.0041d42e
push 0x30
call fcn.00433c21
add esp, 0xc
mov dword [ebp - 0x2c], eax
cmp eax, edi
mov byte [ebp - 4], 0x43
je 0x4312b6
lea ecx, [ebp + 0x262a8]
push ecx
mov ecx, eax
call fcn.0042ec8b
jmp 0x4312b8
xor eax, eax
push eax
mov ecx, esi
mov byte [ebp - 4], 0x3e
call fcn.0045e430
mov ecx, dword [ebp - 0x20]
push esi
call fcn.0045e430
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
call fcn.0045e430
jmp 0x4312e7
lea eax, [ebp + 0x25f28]
push eax
call fcn.0041e59e
pop ecx
push edi
push 1
lea ecx, [ebp + 0x26694]
call fcn.00401770
push edi
push 1
lea ecx, [ebp + 0x26678]
call fcn.00401770
push edi
push 1
lea ecx, [ebp + 0x265d0]
mov byte [ebp - 4], 0x38
call fcn.00401770
jmp 0x431329
lea eax, [ebp + 0x266b0]
push eax
lea ecx, [ebp + 0x2665c]
call fcn.00403470
mov esi, dword [ebp - 0xa8]
cmp esi, edi
je 0x431362
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26598]
push eax
lea ecx, [ebp + 0x2665c]
call fcn.00401ce0
cmp dword [esi + 0x18], 8
jb 0x431353
mov esi, dword [esi + 4]
jmp 0x431356
add esi, 4
push esi
lea ecx, [ebp + 0x2665c]
call fcn.00403470
cmp dword [ebp - 0x10], edi
jne 0x4319ab
push 0x4e31d4
lea ecx, [ebp + 0x26694]
call fcn.004015a0
mov esi, dword [ebp - 0x78]
cmp esi, edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp + 0x26694]
jne 0x43139d
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x2665c]
push eax
call fcn.004038f0
jmp 0x4313e6
push 0x4caf54
call fcn.00403470
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x2665c]
push eax
lea ecx, [ebp + 0x26694]
call fcn.004038f0
push 0x4cc60c
lea ecx, [ebp + 0x26694]
call fcn.00403470
cmp dword [esi + 0x18], 8
jb 0x4313d7
mov esi, dword [esi + 4]
jmp 0x4313da
add esi, 4
push esi
lea ecx, [ebp + 0x26694]
call fcn.00403470
mov esi, dword [ebp - 0x74]
cmp esi, edi
je 0x4316f0
mov eax, dword [ebp - 0xa0]
cmp eax, edi
je 0x431421
cmp dword [eax + 0x18], 8
jb 0x431406
mov eax, dword [eax + 4]
jmp 0x431409
add eax, 4
push 0x4ca850
push eax
call fcn.0043ed1a
test eax, eax
pop ecx
pop ecx
jne 0x431421
mov dword [ebp - 0x6c], 1
cmp dword [esi + 0x18], 8
jb 0x43142c
mov eax, dword [esi + 4]
jmp 0x43142f
lea eax, [esi + 4]
push 0x4cfc48
push eax
call fcn.0043ed1a
test eax, eax
pop ecx
pop ecx
jne 0x4316f0
call fcn.0041e027
test eax, eax
je 0x431495
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x431495
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x431461
mov eax, dword [edi]
jmp 0x431463
mov eax, edi
push str.direct_open
push eax
call fcn.0043ed1a
test eax, eax
pop ecx
pop ecx
je 0x4316ee
cmp dword [esi + 0x18], 8
jb 0x431480
mov edi, dword [edi]
push str.no_open
push edi
call fcn.0043ed1a
test eax, eax
pop ecx
pop ecx
je 0x431975
push 0x50
pop edi
push edi
mov dword [ebp - 0x30], 1
call fcn.00433c21
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x45
je 0x4314c2
push str.PushItem
mov ecx, eax
call fcn.0045f7f0
mov dword [ebp - 0x10], eax
jmp 0x4314c6
and dword [ebp - 0x10], 0
push edi
mov byte [ebp - 4], 0x44
call fcn.00433c21
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x46
je 0x4314ec
push 0x4cfc28
mov ecx, eax
call fcn.0045f7f0
mov esi, eax
jmp 0x4314ee
xor esi, esi
push 0x1f3
lea eax, [ebp + 0x262a9]
push 0
push eax
mov byte [ebp - 4], 0x44
mov byte [ebp + 0x262a8], 0
call fcn.0043db80
mov eax, dword [ebp + 0x26660]
add esp, 0xc
cmp dword [ebp + 0x26674], 8
jae 0x431524
lea eax, [ebp + 0x26660]
lea ecx, [ebp + 0x262a8]
push ecx
push eax
call fcn.0041d42e
push 0x30
pop ebx
push ebx
call fcn.00433c21
add esp, 0xc
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x47
je 0x431558
lea ecx, [ebp + 0x262a8]
push ecx
mov ecx, eax
call fcn.0042ec8b
jmp 0x43155a
xor eax, eax
push eax
mov ecx, esi
mov byte [ebp - 4], 0x44
call fcn.0045e430
mov ecx, dword [ebp - 0x10]
push esi
call fcn.0045e430
push edi
call fcn.00433c21
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x48
je 0x431591
push 0x4cfc18
mov ecx, eax
call fcn.0045f7f0
mov esi, eax
jmp 0x431593
xor esi, esi
mov eax, dword [ebp - 0x78]
test eax, eax
mov byte [ebp - 4], 0x44
je 0x4315f4
cmp dword [eax + 0x18], 8
jb 0x4315a9
mov eax, dword [eax + 4]
jmp 0x4315ac
add eax, 4
lea ecx, [ebp + 0x262a8]
push ecx
push eax
call fcn.0041d42e
push ebx
call fcn.00433c21
add esp, 0xc
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x49
je 0x4315dd
lea ecx, [ebp + 0x262a8]
push ecx
mov ecx, eax
call fcn.0042ec8b
jmp 0x4315df
xor eax, eax
push eax
mov ecx, esi
mov byte [ebp - 4], 0x44
call fcn.0045e430
mov ecx, dword [ebp - 0x10]
push esi
call fcn.0045e430
cmp dword [ebp - 0x14], 0
jne 0x431659
push edi
call fcn.00433c21
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x4a
je 0x43161c
push str.InstallReBootDel
mov ecx, eax
call fcn.0045f7f0
mov esi, eax
jmp 0x43161e
xor esi, esi
push ebx
mov byte [ebp - 4], 0x44
call fcn.00433c21
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x4b
je 0x431642
push str.true
mov ecx, eax
call fcn.0042ec8b
jmp 0x431644
xor eax, eax
push eax
mov ecx, esi
mov byte [ebp - 4], 0x44
call fcn.0045e430
mov ecx, dword [ebp - 0x10]
push esi
call fcn.0045e430
mov esi, dword [ebp - 0x34]
test esi, esi
je 0x4316de
push edi
call fcn.00433c21
pop ecx
mov dword [ebp - 0x34], eax
test eax, eax
mov byte [ebp - 4], 0x4c
je 0x431682
push 0x4cfbcc
mov ecx, eax
call fcn.0045f7f0
mov edi, eax
jmp 0x431684
xor edi, edi
cmp dword [esi + 0x18], 8
mov byte [ebp - 4], 0x44
jb 0x431693
mov eax, dword [esi + 4]
jmp 0x431696
lea eax, [esi + 4]
lea ecx, [ebp + 0x262a8]
push ecx
push eax
call fcn.0041d42e
push ebx
call fcn.00433c21
add esp, 0xc
mov dword [ebp - 0x34], eax
test eax, eax
mov byte [ebp - 4], 0x4d
je 0x4316c7
lea ecx, [ebp + 0x262a8]
push ecx
mov ecx, eax
call fcn.0042ec8b
jmp 0x4316c9
xor eax, eax
push eax
mov ecx, edi
mov byte [ebp - 4], 0x44
call fcn.0045e430
mov ecx, dword [ebp - 0x10]
push edi
call fcn.0045e430
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
call fcn.0045e430
jmp 0x431975
xor edi, edi
mov esi, dword [ebp - 0x60]
cmp esi, edi
je 0x431937
cmp dword [esi + 0x18], 8
jb 0x431706
mov eax, dword [esi + 4]
jmp 0x431709
lea eax, [esi + 4]
push 0x4cfafc
push eax
call fcn.0043ed1a
test eax, eax
pop ecx
pop ecx
jne 0x4317f9
lea ecx, [ebp - 0x5c]
call fcn.0042c3b3
push str.InstallConfig1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x4e
call fcn.004015a0
lea ecx, [ebx + 0x18]
mov eax, dword [ecx]
lea edx, [ebp - 0x58]
push edx
mov byte [ebp - 4], 0x4f
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x58]
mov esi, eax
mov byte [ebp - 4], 0x4e
call fcn.00401770
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x431765
mov eax, dword [edi]
jmp 0x431767
mov eax, edi
push eax
push str.FID:_s
call fcn.004205cc
cmp dword [esi + 0x18], 8
pop ecx
pop ecx
jb 0x43177c
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x5c]
call fcn.0042ca19
push str.FID_end
mov esi, eax
call fcn.004205cc
test esi, esi
pop ecx
je 0x4317e8
push 0x4ca850
lea ecx, [ebp - 0x94]
call fcn.004015a0
push str.InstallFlag
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x50
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x51
call dword [eax + 8]
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.00401770
push 0
push 1
lea ecx, [ebp - 0x94]
call fcn.00401770
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x44
call fcn.0042c3b9
mov esi, dword [ebp - 0x60]
xor edi, edi
cmp dword [esi + 0x18], 8
lea eax, [esi + 4]
mov dword [ebp - 0x14], eax
jb 0x431807
mov eax, dword [eax]
push str.greenbaggame
push eax
call fcn.0043ed1a
test eax, eax
pop ecx
pop ecx
jne 0x43184b
lea ecx, [ebp - 0x15]
call sym.setup_Clover.exe_public:_class_DuiLib::CMarkup____thiscall_DuiLib::CDialogBuilder::GetMarkup_void_
lea eax, [ebx + 0x18]
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x15]
mov byte [ebp - 4], 0x52
call fcn.0042df92
push edi
push 1
lea ecx, [ebp - 0x58]
call fcn.00401770
lea ecx, [ebp - 0x15]
mov byte [ebp - 4], 0x44
call sym.setup_Clover.exe_void___cdecl_DuiLib::DUI__Trace_wchar_t_const__
cmp dword [esi + 0x18], 8
mov eax, dword [ebp - 0x14]
jb 0x431856
mov eax, dword [eax]
push 0x4cfaf4
push eax
call fcn.0043ed1a
test eax, eax
pop ecx
pop ecx
jne 0x431975
lea ecx, [ebp - 0x70]
call fcn.0042c3b3
push str.InstallConfig1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x53
call fcn.004015a0
lea ecx, [ebx + 0x18]
mov eax, dword [ecx]
lea edx, [ebp - 0x58]
push edx
mov byte [ebp - 4], 0x54
call dword [eax + 0x1c]
push 0
push 1
lea ecx, [ebp - 0x58]
mov esi, eax
mov byte [ebp - 4], 0x53
call fcn.00401770
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x4318b3
mov eax, dword [edi]
jmp 0x4318b5
mov eax, edi
push eax
push str.lock:_s
call fcn.004205cc
cmp dword [esi + 0x18], 8
pop ecx
pop ecx
jb 0x4318ca
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x70]
call fcn.0042c63c
test eax, eax
je 0x431929
push 0x4ca850
lea ecx, [ebp - 0x94]
call fcn.004015a0
push str.InstallFlag
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x55
call fcn.004015a0
mov eax, dword [ebx]
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x56
call dword [eax + 8]
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.00401770
push 0
push 1
lea ecx, [ebp - 0x94]
call fcn.00401770
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x44
call fcn.0042c3b9
jmp 0x431975
cmp dword [ebp + 0x266ac], 8
mov eax, dword [ebp + 0x26698]
jae 0x43194c
lea eax, [ebp + 0x26698]
push eax
call fcn.0041e59e
cmp dword [ebp + 0x266ac], 8
mov eax, dword [ebp + 0x26698]
pop ecx
jae 0x431968
lea eax, [ebp + 0x26698]
push eax
push 0x4ca39c
call fcn.004205cc
pop ecx
pop ecx
xor esi, esi
cmp dword [ebp - 0x64], esi
je 0x43199b
cmp dword [ebp + 0x26674], 8
mov eax, dword [ebp + 0x26660]
jae 0x431991
lea eax, [ebp + 0x26660]
push 5
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push esi
push 1
lea ecx, [ebp + 0x26694]
call fcn.00401770
xor edi, edi
push edi
push 1
lea ecx, [ebp + 0x26624]
call fcn.00401770
push edi
push 1
lea ecx, [ebp + 0x2665c]
call fcn.00401770
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x2e
call fcn.00401410
push edi
push 1
lea ecx, [ebp + 0x26608]
call fcn.00401770
push edi
push 1
lea ecx, [ebp + 0x26640]
call fcn.00401770
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0xd
call fcn.0040dd85
lea ecx, [ebp - 0x9c]
call fcn.0040e04a
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + 8]
push ecx
push eax
lea ecx, [ebp - 0xb4]
call fcn.0040e876
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x9c]
call fcn.0040a8bf
test al, al
je 0x4300fe
push dword [ebp - 0x24]
mov ecx, dword [ebp - 0x38]
call fcn.0045e430
push dword [ebp - 0x38]
lea ecx, [ebp - 0x278]
call fcn.0045e430
cmp dword [ebp + 0x26578], 0x10
mov eax, dword [ebp + 0x26564]
jae 0x431a67
lea eax, [ebp + 0x26564]
push eax
lea ecx, [ebp - 0x278]
call fcn.0045ef90
cmp dword [ebp + 0x265cc], 8
mov eax, dword [ebp + 0x265b8]
mov dword [ebp - 0x10], edi
jae 0x431a8b
lea eax, [ebp + 0x265b8]
push edi
push 0x80
push 4
push edi
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x431ab4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
inc esi
push esi
call fcn.00433c4c
push esi
push edi
push eax
mov dword [ebp - 0x24], eax
call fcn.0043db80
add esp, 0x10
push edi
lea eax, [ebp - 0xa4]
push eax
push esi
push dword [ebp - 0x24]
mov dword [ebp - 0xa4], edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0x2649c]
push eax
lea eax, [ebp + 0x2650c]
push eax
call fcn.0041f2d4
pop ecx
pop ecx
cmp dword [ebp + 0x265cc], 8
mov eax, dword [ebp + 0x265b8]
mov byte [ebp - 4], 0x57
jae 0x431b1a
lea eax, [ebp + 0x265b8]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
push str.GUANGSU
call fcn.0043e060
pop ecx
xor ecx, ecx
xor edx, edx
cmp dword [ebp - 0x10], edi
mov dword [ebp - 0x1c], eax
jle 0x431b55
mov eax, dword [ebp - 0x24]
mov bl, byte [ecx + str.GUANGSU]
add eax, edx
xor byte [eax], bl
inc ecx
cmp ecx, dword [ebp - 0x1c]
jl 0x431b4f
xor ecx, ecx
inc edx
cmp edx, dword [ebp - 0x10]
jl 0x431b3a
cmp dword [ebp + 0x26524], 8
mov eax, dword [ebp + 0x26510]
jae 0x431b6a
lea eax, [ebp + 0x26510]
push eax
call esi
lea eax, [ebp + 0x264d4]
push eax
lea eax, [ebp + 0x2657c]
push eax
call fcn.0041f2d4
pop ecx
pop ecx
cmp dword [ebp + 0x26594], 8
mov eax, dword [ebp + 0x26580]
mov byte [ebp - 4], 0x58
jae 0x431b9b
lea eax, [ebp + 0x26580]
push eax
call fcn.0041ef3a
cmp dword [ebp + 0x26594], 8
mov eax, dword [ebp + 0x26580]
pop ecx
jae 0x431bb7
lea eax, [ebp + 0x26580]
push edi
push 0x80
xor esi, esi
inc esi
push esi
push edi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x431bf2
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], edi
push dword [ebp - 0x24]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x30], edi
je 0x431d4b
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x4e31d4
push esi
lea ecx, [ebp + 0x26624]
call fcn.004015a0
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26598]
push eax
lea ecx, [ebp + 0x26624]
mov byte [ebp - 4], 0x59
call fcn.00401ce0
push str.Util32.exe
lea ecx, [ebp + 0x26624]
call fcn.00403470
push esi
lea ecx, [ebp + 0x26678]
call fcn.004015a0
mov ebx, 0x4caf54
push ebx
lea ecx, [ebp + 0x26678]
mov byte [ebp - 4], 0x5a
call fcn.00403360
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26624]
push eax
lea ecx, [ebp + 0x26678]
call fcn.004038f0
push str.__UnVuSW50ZXJmYWNl
lea ecx, [ebp + 0x26678]
call fcn.00403470
cmp dword [ebp - 0x6c], edi
jne 0x431cac
cmp dword [ebp + 0x26690], 8
mov eax, dword [ebp + 0x2667c]
jae 0x431ca0
lea eax, [ebp + 0x2667c]
push eax
call fcn.0041e59e
pop ecx
jmp 0x431d2c
push esi
lea ecx, [ebp + 0x26640]
call fcn.004015a0
push ebx
lea ecx, [ebp + 0x26640]
mov byte [ebp - 4], 0x5b
call fcn.00403360
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x264b8]
push eax
lea ecx, [ebp + 0x26640]
call fcn.004038f0
push 0x4cc60c
lea ecx, [ebp + 0x26640]
call fcn.00403470
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26624]
push eax
lea ecx, [ebp + 0x26640]
call fcn.004038f0
cmp dword [ebp + 0x26658], 8
mov eax, dword [ebp + 0x26644]
jae 0x431d17
lea eax, [ebp + 0x26644]
push eax
call fcn.0041e59e
pop ecx
push edi
push 1
lea ecx, [ebp + 0x26640]
call fcn.00401770
push edi
push 1
lea ecx, [ebp + 0x26678]
call fcn.00401770
push edi
push 1
lea ecx, [ebp + 0x26624]
call fcn.00401770
xor esi, esi
inc esi
push dword [ebp - 0x24]
call fcn.004ba1f5
pop ecx
push edi
push esi
lea ecx, [ebp + 0x2657c]
call fcn.00401770
push edi
push esi
lea ecx, [ebp + 0x2650c]
call fcn.00401770
push edi
push esi
lea ecx, [ebp + 0x26528]
call fcn.00401770
push edi
push esi
lea ecx, [ebp + 0x264f0]
call fcn.00401770
push edi
push esi
lea ecx, [ebp + 0x26544]
call fcn.00401770
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 6
call fcn.0040e331
push edi
push esi
lea ecx, [ebp + 0x264d4]
call fcn.00401720
push edi
push esi
lea ecx, [ebp + 0x2649c]
call fcn.00401720
push edi
push esi
lea ecx, [ebp + 0x265b4]
call fcn.00401770
push edi
push esi
lea ecx, [ebp + 0x26560]
call fcn.00401720
push edi
push esi
lea ecx, [ebp + 0x264b8]
call fcn.00401770
push edi
push esi
lea ecx, [ebp + 0x265ec]
call fcn.00401770
push edi
push esi
lea ecx, [ebp + 0x26598]
call fcn.00401770
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x268b8]
xor ecx, ebp
call fcn.0043db65
add ebp, 0x268bc
leave
ret 4