Function at 0x43ca00
Capabilities:
Check if file exists
Check os version
Compare security identifiers
Create process on windows
Delete directory
Delete file
Enumerate gui resources
Enumerate processes
Get common file path
Move file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d8e82
mov eax, dword fs:[0]
push eax
sub esp, 0xe70
mov eax, dword [0x536f50]
xor eax, esp
mov dword [esp + 0xe68], eax
push ebx
push esi
push edi
mov eax, dword [0x536f50]
xor eax, esp
push eax
lea eax, [esp + 0xe80]
mov dword fs:[0], eax
xor edi, edi
mov ebx, ecx
push edi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 0xc6c]
push 0x104
push eax
call fcn.0043e3b0
sub esp, 0x14
mov ecx, esp
xor edx, edx
lea eax, [esp + 0xc88]
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], edi
mov dword [esp + 0x2c], esp
mov word [ecx + 4], dx
lea esi, [eax + 2]
jmp 0x43ca90
mov dx, word [eax]
add eax, 2
cmp dx, di
jne 0x43ca90
sub eax, esi
sar eax, 1
push eax
lea eax, [esp + 0xc8c]
push eax
call fcn.00402500
lea ecx, [esp + 0x1a8]
push ecx
call fcn.0042da90
add esp, 0x20
push 0x18
mov esi, 0xf
push str.SoftWareKuaizipInstall
lea ecx, [esp + 0xbc]
mov dword [esp + 0xe90], edi
mov dword [esp + 0xd4], esi
mov dword [esp + 0xd0], edi
mov byte [esp + 0xc0], 0
call fcn.00404570
push edi
push edi
lea edx, [esp + 0xbc]
push edx
push reloc.WS2_32.dll_accept
lea ecx, [esp + 0x1b8]
mov byte [esp + 0xe98], 1
call fcn.004d17d0
cmp dword [esp + 0xcc], 0x10
mov byte [esp + 0xe88], 3
jb 0x43cb37
mov eax, dword [esp + 0xb8]
push eax
call fcn.004798f2
add esp, 4
push 3
push 0x4e0878
lea ecx, [esp + 0x7c]
mov dword [esp + 0xd4], esi
mov dword [esp + 0xd0], edi
mov byte [esp + 0xc0], 0
mov dword [esp + 0x94], esi
mov dword [esp + 0x90], edi
mov byte [esp + 0x80], 0
call fcn.00404570
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x9c]
push edx
lea ecx, [esp + 0x1b0]
mov byte [esp + 0xe90], 4
call fcn.004d1960
push 0x53ab84
push 0x53ab68
push 0x53ab4c
push 0x53ab30
push 0x53ab14
push 0x53aaf8
push eax
push 0x53aadc
push 0x53aac0
mov byte [esp + 0xeac], 5
call fcn.004d62d0
add esp, 0x24
cmp dword [esp + 0xb0], 0x10
jb 0x43cbe7
mov eax, dword [esp + 0x9c]
push eax
call fcn.004798f2
add esp, 4
cmp dword [esp + 0x8c], 0x10
mov dword [esp + 0xb0], esi
mov dword [esp + 0xac], edi
mov byte [esp + 0x9c], 0
mov byte [esp + 0xe88], 3
jb 0x43cc1c
mov ecx, dword [esp + 0x78]
push ecx
call fcn.004798f2
add esp, 4
call fcn.004d5de0
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebx]
mov eax, dword [edx]
push 0x4e1fd0
push 0x7f3
mov ecx, ebx
call eax
call fcn.00429930
call fcn.0042e4c0
mov edx, dword [ebx]
mov eax, dword [edx]
push 0x4e1fcc
push 0x7f3
mov ecx, ebx
call eax
push str.kuaizipUpdateChecker.dll
lea ecx, [esp + 0x190]
push ecx
lea edx, [esp + 0x7c]
push edx
call fcn.0041b480
push 0x208
lea ecx, [esp + 0x866]
xor eax, eax
push edi
push ecx
mov byte [esp + 0xea0], 6
mov word [esp + 0x86c], ax
call fcn.0047a920
add esp, 0x18
push 0x104
lea edx, [esp + 0x858]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
mov word [esp + 0x158], ax
lea eax, [esp + 0x854]
mov dword [esp + 0x16c], 7
mov dword [esp + 0x168], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x43ccd2
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x858]
push ecx
lea ecx, [esp + 0x15c]
call fcn.00402500
push 0xd
push 0x4dfd2c
lea ecx, [esp + 0x15c]
mov byte [esp + 0xe90], 7
call fcn.0040fbe0
mov eax, dword [esp + 0x78]
mov esi, 8
cmp dword [esp + 0x8c], esi
jae 0x43cd27
lea eax, [esp + 0x78]
push 0x4dfd28
push eax
call fcn.0047ab84
add esp, 8
test eax, eax
je 0x43ce7f
push 1
xor edx, edx
mov ebx, 7
push 0x4dfd24
lea ecx, [esp + 0xa0]
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xb4], edi
mov word [esp + 0xa4], dx
call fcn.00402500
push 1
xor eax, eax
push 0x4dfd24
lea ecx, [esp + 0x44]
mov byte [esp + 0xe90], 8
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x58], edi
mov word [esp + 0x48], ax
call fcn.00402500
lea ecx, [esp + 0x74]
push ecx
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x60]
push eax
mov byte [esp + 0xe94], 9
call fcn.004107a0
lea ecx, [esp + 0xa4]
push ecx
push eax
lea edx, [esp + 0xe4]
push edx
mov byte [esp + 0xea0], 0xa
call fcn.004107a0
add esp, 0x18
push 0xffffffffffffffff
push edi
push eax
lea ecx, [esp + 0x80]
mov byte [esp + 0xe94], 0xb
call fcn.00401da0
cmp dword [esp + 0xe8], esi
jb 0x43ce02
mov eax, dword [esp + 0xd4]
push eax
call fcn.004798f2
add esp, 4
xor ecx, ecx
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xe4], edi
mov word [esp + 0xd4], cx
cmp dword [esp + 0x70], esi
jb 0x43ce2d
mov edx, dword [esp + 0x5c]
push edx
call fcn.004798f2
add esp, 4
xor eax, eax
mov dword [esp + 0x70], ebx
mov dword [esp + 0x6c], edi
mov word [esp + 0x5c], ax
cmp dword [esp + 0x54], esi
jb 0x43ce4f
mov ecx, dword [esp + 0x40]
push ecx
call fcn.004798f2
add esp, 4
xor edx, edx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x50], edi
mov word [esp + 0x40], dx
mov byte [esp + 0xe88], 7
cmp dword [esp + 0xb0], esi
jb 0x43ce7f
mov eax, dword [esp + 0x9c]
push eax
call fcn.004798f2
add esp, 4
push 5
push 0x4dfd18
lea ecx, [esp + 0x15c]
call fcn.0040fbe0
push 5
push 0x4dfd0c
lea ecx, [esp + 0x15c]
call fcn.0040fbe0
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x7c]
push ecx
lea ecx, [esp + 0x160]
call fcn.00410670
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
sub esp, 0x1c
mov edx, esp
mov dword [esp + 0x2c], esp
push eax
push edx
call fcn.0042db20
lea eax, [esp + 0x7c]
add esp, 8
push eax
call fcn.0042cb40
add esp, 0x20
mov ecx, dword [eax + 0x14]
push 6
push 0x4ded34
push ecx
push edi
mov ecx, eax
mov byte [esp + 0xe98], 0xc
call fcn.00410570
test eax, eax
sete bl
mov byte [esp + 0xe88], 7
cmp dword [esp + 0x70], esi
jb 0x43cf1a
mov edx, dword [esp + 0x5c]
push edx
call fcn.004798f2
add esp, 4
test bl, bl
je 0x43d86a
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0xffffffffffffffff
push edi
lea edx, [esp + 0x178]
xor eax, eax
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], edi
push edx
mov word [ecx + 4], ax
call fcn.00401da0
lea eax, [esp + 0x74]
push eax
call fcn.0041b8b0
add esp, 0x20
cmp dword [eax + 0x18], 0x10
mov byte [esp + 0xe88], 0xd
jb 0x43cf6f
mov ebx, dword [eax + 4]
mov dword [esp + 0x30], ebx
jmp 0x43cf78
add eax, 4
mov dword [esp + 0x30], eax
mov ebx, eax
cmp ebx, edi
je 0x43d850
push 0x103
lea ecx, [esp + 0x751]
push edi
push ecx
mov byte [esp + 0x758], 0
call fcn.0047a920
mov eax, ebx
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x43cfa3
sub eax, edx
cmp eax, 2
jbe 0x43cfcf
cmp byte [ebx + 1], 0x3a
jne 0x43cfcf
push ebx
lea edx, [esp + 0x750]
push 0x104
push edx
call fcn.0047d212
add esp, 0xc
jmp 0x43d000
push 0x104
lea eax, [esp + 0x750]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x74c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push ebx
lea edx, [esp + 0x750]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push pe_nt_image_headers32
lea eax, [esp + 0x524]
push edi
push eax
call fcn.0047a920
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [esp + 0x51c]
push ecx
mov dword [esp + 0x520], 0x114
xor esi, esi
call ebx
test eax, eax
je 0x43d046
cmp dword [esp + 0x520], 6
jne 0x43d046
mov esi, 1
mov dword [esp + 0x24], edi
cmp esi, edi
jne 0x43d315
push pe_nt_image_headers32
lea edx, [esp + 0x1dc]
push edi
push edx
call fcn.0047a920
add esp, 0xc
lea eax, [esp + 0x1d4]
push eax
mov dword [esp + 0x1d8], 0x114
call ebx
test eax, eax
je 0x43d098
cmp dword [esp + 0x1d8], 5
jne 0x43d098
cmp dword [esp + 0x1dc], edi
je 0x43d22f
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x18]
push edx
push 1
push edi
push edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x3c], edi
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
cmp eax, edi
je 0x43d0f9
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x14]
xor eax, eax
mov esi, 0x490
cmp edx, edi
jbe 0x43d0eb
lea ecx, [ebx + 8]
cmp dword [ecx], edi
je 0x43d0df
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x43d0d1
jmp 0x43d0eb
lea eax, [eax + eax*2]
mov ecx, dword [ebx + eax*4]
mov dword [esp + 0x18], ecx
xor esi, esi
push ebx
call sub.WTSAPI32.dll_WTSFreeMemory
cmp esi, edi
je 0x43d0f9
mov eax, esi
jmp 0x43d12e
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x43d128
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x24]
push edx
push ecx
call eax
cmp eax, edi
jne 0x43d4e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
je 0x43d4e5
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x43d4d7
push 0x228
lea edx, [esp + 0x2f4]
push edi
push edx
xor ebx, ebx
mov dword [esp + 0x20], 0x490
call fcn.0047a920
add esp, 0xc
lea eax, [esp + 0x2ec]
push eax
push esi
mov dword [esp + 0x2f4], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x43d1ca
jmp 0x43d190
lea ecx, [esp + 0x310]
push str.explorer.exe
push ecx
call fcn.0047b50a
add esp, 8
test eax, eax
je 0x43d1bd
lea edx, [esp + 0x2ec]
push edx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43d190
jmp 0x43d1d4
mov ebx, dword [esp + 0x2f4]
mov dword [esp + 0x14], edi
jmp 0x43d1d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push edi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
je 0x43d4d7
lea eax, [esp + 0x24]
push eax
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, edi
jne 0x43d21d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x43d4dd
mov ebx, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x43d4dd
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x43d4d7
push 0x228
lea ecx, [esp + 0x2f4]
push 0
push ecx
mov ebx, 0x490
call fcn.0047a920
add esp, 0xc
lea edx, [esp + 0x2ec]
push edx
push esi
mov dword [esp + 0x2f4], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x43d2b8
jmp 0x43d280
lea eax, [esp + 0x310]
push str.explorer.exe
push eax
call fcn.0047b50a
add esp, 8
test eax, eax
je 0x43d2ad
lea ecx, [esp + 0x2ec]
push ecx
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43d280
jmp 0x43d2c0
mov edi, dword [esp + 0x2f4]
xor ebx, ebx
jmp 0x43d2c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x43d2e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
jmp 0x43d4dd
lea edx, [esp + 0x24]
push edx
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x43d305
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
xor edi, edi
jmp 0x43d4dd
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x18]
push ecx
push 1
push edi
push edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x3c], edi
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
cmp eax, edi
je 0x43d37a
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x14]
xor eax, eax
mov esi, 0x490
cmp edx, edi
jbe 0x43d36c
lea ecx, [ebx + 8]
cmp dword [ecx], edi
je 0x43d360
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x43d352
jmp 0x43d36c
lea edx, [eax + eax*2]
mov eax, dword [ebx + edx*4]
mov dword [esp + 0x18], eax
xor esi, esi
push ebx
call sub.WTSAPI32.dll_WTSFreeMemory
cmp esi, edi
je 0x43d37a
mov eax, esi
jmp 0x43d3af
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x43d3a9
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push edx
call eax
cmp eax, edi
jne 0x43d4a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
je 0x43d4a3
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x43d3d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x43d49b
push 0x228
lea eax, [esp + 0x2f4]
push 0
push eax
mov ebx, 0x490
call fcn.0047a920
add esp, 0xc
lea ecx, [esp + 0x2ec]
push ecx
push esi
mov dword [esp + 0x2f4], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x43d448
lea ebx, [ebx]
lea edx, [esp + 0x310]
push str.explorer.exe
push edx
call fcn.0047b50a
add esp, 8
test eax, eax
je 0x43d43d
lea eax, [esp + 0x2ec]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x43d410
jmp 0x43d450
mov edi, dword [esp + 0x2f4]
xor ebx, ebx
jmp 0x43d450
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x43d473
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x43d499
lea ecx, [esp + 0x1c]
push ecx
push 0xf01ff
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x43d490
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
xor edi, edi
cmp eax, edi
jne 0x43d83a
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x14c]
push edx
push 4
lea eax, [esp + 0x18]
push eax
push 0x13
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x43d4cd
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x24], edx
jmp 0x43d4e5
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
jmp 0x43d4e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jne 0x43d83a
push 0x40
xor esi, esi
lea ecx, [esp + 0x10c]
push esi
push ecx
mov dword [esp + 0x110], 0x44
call fcn.0047a920
add esp, 0xc
mov edi, dword [esp + 0x24]
lea edx, [esp + 0x1c]
push edx
push esi
push esi
push esi
push esi
xor eax, eax
push esi
push esi
push 0x220
push 0x20
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov byte [esp + 0x47], al
mov byte [esp + 0x170], al
mov byte [esp + 0x171], al
mov byte [esp + 0x172], al
mov byte [esp + 0x173], al
mov byte [esp + 0x174], al
push 2
lea eax, [esp + 0x174]
push eax
mov dword [esp + 0x68], esi
mov dword [esp + 0x48], esi
mov byte [esp + 0x17d], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x43d5ed
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea ecx, [esp + 0x18]
push ecx
push esi
push esi
push 2
push edi
call ebx
test eax, eax
jne 0x43d595
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x43d5ed
mov edx, dword [esp + 0x18]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [esp + 0x18]
mov esi, eax
lea eax, [esp + 0x18]
push eax
push ecx
push esi
push 2
push edi
call ebx
test eax, eax
je 0x43d5e2
xor edi, edi
cmp dword [esi], edi
jbe 0x43d5e2
lea ebx, [esi + 4]
mov edx, dword [ebx]
mov eax, dword [esp + 0x1c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x43d5dd
inc edi
add ebx, 8
cmp edi, dword [esi]
jb 0x43d5c1
jmp 0x43d5e2
mov byte [esp + 0x23], 1
test esi, esi
je 0x43d5ed
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x1c]
xor esi, esi
cmp eax, esi
je 0x43d5fe
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp byte [esp + 0x23], 0
jne 0x43d72e
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x14]
push edx
push 1
push esi
push esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x40], esi
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
cmp eax, esi
jne 0x43d67f
push pe_nt_image_headers32
lea eax, [esp + 0x63c]
push esi
push eax
call fcn.0047a920
add esp, 0xc
lea ecx, [esp + 0x634]
push ecx
mov dword [esp + 0x638], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x43d679
cmp dword [esp + 0x638], 6
jne 0x43d679
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x43d6ba
mov dword [esp + 0x28], esi
jmp 0x43d6be
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x10]
xor eax, eax
mov esi, 0x490
test edx, edx
jbe 0x43d6b0
lea ecx, [edi + 8]
cmp dword [ecx], 0
je 0x43d6a4
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x43d695
jmp 0x43d6b0
lea edx, [eax + eax*2]
mov eax, dword [edi + edx*4]
mov dword [esp + 0x28], eax
xor esi, esi
push edi
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, esi
xor esi, esi
cmp eax, esi
jne 0x43d72e
lea ecx, [esp + 0x1c]
push ecx
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x43d72e
lea edx, [esp + 0x18]
push edx
push 1
push 1
push esi
push 0x2000000
push eax
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
cmp dword [esp + 0x18], esi
jne 0x43d703
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x43d72e
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
push 4
lea edx, [esp + 0x2c]
push edx
push 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x43d72e
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x24], ecx
xor edi, edi
push str.userenv.dll
mov dword [esp + 0x110], str.Winsta0Default
mov ebx, 0x30
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x43d79c
push str.CreateEnvironmentBlock
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DestroyEnvironmentBlock
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x10], eax
test edi, edi
je 0x43d79c
mov edx, dword [esp + 0x24]
push 0
push edx
lea eax, [esp + 0x1c]
push eax
call edi
test eax, eax
je 0x43d794
mov ebx, 0x430
jmp 0x43d79c
mov dword [esp + 0x14], 0
push 0x103
lea ecx, [esp + 0x1d9]
push 0
push ecx
mov byte [esp + 0x1e0], 0
call fcn.0047a920
mov edx, dword [esp + 0x3c]
push edx
lea eax, [esp + 0x1e4]
push 0x103
push eax
call fcn.0047d212
mov eax, dword [esp + 0x2c]
add esp, 0x18
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x108]
push edx
mov edx, dword [esp + 0x2c]
push 0
push eax
push ebx
push 0
push 0
push 0
lea ecx, [esp + 0x1f4]
push ecx
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x43d811
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x40]
test eax, eax
je 0x43d820
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x43d82f
mov ecx, dword [esp + 0x14]
push ecx
call eax
test esi, esi
je 0x43d83a
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x43d849
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 8
xor edi, edi
cmp dword [esp + 0x70], 0x10
jb 0x43d8e2
mov eax, dword [esp + 0x5c]
push eax
call fcn.004798f2
add esp, 4
jmp 0x43d8e2
push 0x44
lea ecx, [esp + 0x108]
push edi
push ecx
call fcn.0047a920
mov eax, dword [esp + 0x164]
add esp, 0xc
mov dword [esp + 0x104], 0x44
cmp dword [esp + 0x16c], esi
jae 0x43d89f
lea eax, [esp + 0x158]
lea edx, [esp + 0x3c]
push edx
lea ecx, [esp + 0x108]
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x43d8e2
mov edx, dword [esp + 0x3c]
push 0xdbba0
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x3c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
mov ecx, dword [esp + 0x40]
push ecx
call ebx
cmp dword [esp + 0x16c], esi
jb 0x43d8fb
mov edx, dword [esp + 0x158]
push edx
call fcn.004798f2
add esp, 4
xor eax, eax
mov dword [esp + 0x16c], 7
mov dword [esp + 0x168], edi
mov word [esp + 0x158], ax
mov byte [esp + 0xe88], 3
cmp dword [esp + 0x8c], esi
jb 0x43d935
mov ecx, dword [esp + 0x78]
push ecx
call fcn.004798f2
add esp, 4
mov esi, dword [esp + 0x34]
mov edx, dword [esi]
mov eax, dword [edx]
push 0x4e1fc8
push 0x7f3
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx]
push 0x4e1fc4
push 0x7f3
mov ecx, esi
call eax
call fcn.0042d540
mov edx, dword [esi]
mov eax, dword [edx]
push 0x4e1fc0
push 0x7f3
mov ecx, esi
call eax
push 0
push 0x429dd0
call dword [sym.imp.USER32.dll_EnumWindows]
mov edx, dword [esi]
mov eax, dword [edx]
push 0x4e1fbc
push 0x7f3
mov ecx, esi
call eax
call fcn.0042cf20
lea ecx, [esp + 0xec]
call fcn.00422ae0
lea ecx, [esp + 0xec]
push ecx
mov byte [esp + 0xe8c], 0xe
call fcn.0042f610
add esp, 4
call fcn.0041ded0
call fcn.0041aff0
call fcn.0043b510
mov edx, dword [esi]
mov eax, dword [edx]
push 0x4e1fb8
push 0x7f3
mov ecx, esi
call eax
push 0
push 0
push 0x2000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xc8
call edi
push 0x64
call edi
push 0
push str._f__im__KZMount2.exe
push str.taskkill.exe
push 0
call fcn.004d3c50
push 0
push str._f__im__KuaiZip.exe
push str.taskkill.exe
push 0
call fcn.004d3c50
push 0
push str._f__im__Update.exe
push str.taskkill.exe
push 0
call fcn.004d3c50
push 0
push str._f__im__KZReport.exe
push str.taskkill.exe
push 0
call fcn.004d3c50
add esp, 0x40
call fcn.0042d3b0
mov edx, dword [esi]
push 0x4e1fb4
mov eax, dword [edx]
push 0x7f3
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx]
push 0x4e1fb0
push 0x7f3
mov ecx, esi
call eax
call fcn.0042a040
push 0x4e0524
call fcn.0042ee90
push 0x4e0510
call fcn.0042ee90
push 0x4fbc8f
push str.app_uninstall_done
call fcn.0041ce80
mov ecx, dword [0x53a8c4]
mov edi, dword [ecx]
mov esi, dword [0x53a8b0]
add esp, 0x10
mov ebx, dword [0x53a8c4]
test esi, esi
je 0x43dac5
cmp esi, dword [0x53a8b0]
je 0x43daca
call fcn.0047b9cb
cmp edi, ebx
je 0x43db37
test esi, esi
jne 0x43db2b
call fcn.0047b9cb
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x43dae3
call fcn.0047b9cb
mov eax, dword [edi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43db12
test esi, esi
jne 0x43db2f
call fcn.0047b9cb
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x43db06
call fcn.0047b9cb
mov edx, dword [edi + 8]
push edx
call fcn.00429b00
add esp, 4
test esi, esi
jne 0x43db33
call fcn.0047b9cb
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x43db27
call fcn.0047b9cb
mov edi, dword [edi]
jmp 0x43dab3
mov eax, dword [esi]
jmp 0x43dad9
mov eax, dword [esi]
jmp 0x43dafc
mov eax, dword [esi]
jmp 0x43db1d
mov dword [esp + 0x10], 0
nop
mov eax, dword [0x53a8e0]
mov esi, dword [eax]
mov edi, dword [0x53a8cc]
lea ecx, [ecx]
mov ebx, dword [0x53a8e0]
test edi, edi
je 0x43db62
cmp edi, dword [0x53a8cc]
je 0x43db67
call fcn.0047b9cb
cmp esi, ebx
je 0x43dbf8
test edi, edi
jne 0x43dbce
call fcn.0047b9cb
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x43db84
call fcn.0047b9cb
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43dbda
test edi, edi
jne 0x43dbd2
call fcn.0047b9cb
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x43dba7
call fcn.0047b9cb
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x43dbda
test edi, edi
jne 0x43dbd6
call fcn.0047b9cb
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x43dbca
call fcn.0047b9cb
mov esi, dword [esi]
jmp 0x43db50
mov eax, dword [edi]
jmp 0x43db7a
mov eax, dword [edi]
jmp 0x43db9d
mov eax, dword [edi]
jmp 0x43dbc0
push esi
push edi
lea ecx, [esp + 0x154]
push ecx
mov ecx, 0x53a8cc
call fcn.0042d8b0
mov edi, dword [eax]
mov esi, dword [eax + 4]
jmp 0x43db50
mov ecx, dword [0x53a8e4]
test ecx, ecx
je 0x43dcf4
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x63
mov dword [esp + 0x10], eax
jl 0x43db40
test ecx, ecx
jbe 0x43dcf4
mov edx, dword [0x53a8e0]
mov ebx, dword [edx]
mov esi, dword [0x53a8cc]
mov edi, edi
mov edi, dword [0x53a8e0]
test esi, esi
je 0x43dc42
cmp esi, dword [0x53a8cc]
je 0x43dc47
call fcn.0047b9cb
cmp ebx, edi
je 0x43dcf4
test esi, esi
jne 0x43dce1
call fcn.0047b9cb
xor eax, eax
cmp ebx, dword [eax + 0x14]
jne 0x43dc68
call fcn.0047b9cb
mov eax, dword [ebx + 8]
lea edi, [ebx + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43dcc5
test esi, esi
jne 0x43dce8
call fcn.0047b9cb
xor eax, eax
cmp ebx, dword [eax + 0x14]
jne 0x43dc8e
call fcn.0047b9cb
lea eax, [esp + 0xec]
push eax
push edi
call fcn.0042ebb0
add esp, 8
test eax, eax
jne 0x43dcc5
test esi, esi
jne 0x43dcec
call fcn.0047b9cb
xor eax, eax
cmp ebx, dword [eax + 0x14]
jne 0x43dcb8
call fcn.0047b9cb
mov ecx, dword [edi]
push 4
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test esi, esi
jne 0x43dcf0
call fcn.0047b9cb
xor eax, eax
cmp ebx, dword [eax + 0x14]
jne 0x43dcda
call fcn.0047b9cb
mov ebx, dword [ebx]
jmp 0x43dc30
mov eax, dword [esi]
jmp 0x43dc5e
mov eax, dword [esi]
jmp 0x43dc84
mov eax, dword [esi]
jmp 0x43dcae
mov eax, dword [esi]
jmp 0x43dcd0
lea edx, [esp + 0x58]
push edx
call fcn.004d6500
add esp, 4
mov esi, 0x10
mov byte [esp + 0xe88], 0xf
cmp dword [eax + 0x18], esi
jb 0x43dd18
mov eax, dword [eax + 4]
jmp 0x43dd1b
add eax, 4
push eax
lea eax, [esp + 0x174]
push eax
call fcn.004d3840
add esp, 8
mov byte [esp + 0xe88], 0x11
cmp dword [esp + 0x70], esi
jb 0x43dd47
mov ecx, dword [esp + 0x5c]
push ecx
call fcn.004798f2
add esp, 4
mov eax, dword [esp + 0x174]
xor edi, edi
mov esi, 8
mov dword [esp + 0x70], 0xf
mov dword [esp + 0x6c], edi
mov byte [esp + 0x5c], 0
cmp dword [esp + 0x188], esi
jae 0x43dd76
lea eax, [esp + 0x174]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x43ddcf
mov eax, dword [esp + 0x174]
cmp dword [esp + 0x188], esi
jae 0x43dd98
lea eax, [esp + 0x174]
push eax
lea ecx, [esp + 0x14]
call fcn.00401870
lea edx, [esp + 0xec]
push edx
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0xe90], 0x12
mov dword [esp + 0x40], 1
call fcn.0042ebb0
add esp, 8
test eax, eax
jne 0x43ddcf
mov bl, 1
jmp 0x43ddd1
xor bl, bl
test byte [esp + 0x38], 1
mov dword [esp + 0xe88], 0x11
je 0x43de03
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43de03
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x43de28
mov eax, dword [esp + 0x174]
cmp dword [esp + 0x188], esi
jae 0x43de1e
lea eax, [esp + 0x174]
push 4
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
call fcn.0042e690
call fcn.00429f20
push 1
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx]
mov eax, dword [edx]
push 0x4e1fac
push 0x7f3
call eax
call fcn.00429c50
push 0x206
lea edx, [esp + 0xa6a]
xor ecx, ecx
push edi
push edx
mov word [esp + 0xa70], cx
call fcn.0047a920
add esp, 0xc
push 0x208
lea eax, [esp + 0xa68]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 4
push edi
lea ecx, [esp + 0xa6c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [esp + 0x188], esi
jb 0x43deb7
mov edx, dword [esp + 0x174]
push edx
call fcn.004798f2
add esp, 4
xor eax, eax
lea ecx, [esp + 0xec]
mov dword [esp + 0x188], 7
mov dword [esp + 0x184], edi
mov word [esp + 0x174], ax
mov byte [esp + 0xe88], 3
call fcn.0042f180
lea ecx, [esp + 0x1a8]
mov byte [esp + 0xe88], 0
call fcn.004d17b0
cmp dword [esp + 0x1a4], esi
jb 0x43df14
mov ecx, dword [esp + 0x190]
push ecx
call fcn.004798f2
add esp, 4
mov ecx, dword [esp + 0xe80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xe68]
xor ecx, esp
call fcn.0047a885
mov esp, ebp
pop ebp
ret