Function at 0x42fe33
Capabilities:
Contain obfuscated stackstrings
Delete file
Delete registry key
Get common file path
Get file size
Move file
Parse pe header
Read file on windows
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x268bc]
mov eax, 0x268bc
call fcn.0043ddc0
push 0xffffffffffffffff
push 0x4c54d8
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x509690]
xor eax, ebp
mov dword [ebp + 0x268b8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
call fcn.0040d288
mov ecx, eax
call fcn.0040aae0
push eax
lea ecx, [ebp + 0x26598]
call fcn.004015d0
xor edi, edi
push 0x4e3174
lea ecx, [ebp + 0x26598]
mov dword [ebp - 4], edi
call fcn.00403470
lea eax, [ebp + 0x26598]
push eax
lea ecx, [ebp + 0x265ec]
call fcn.00403330
lea eax, [ebp + 0x26598]
push eax
lea ecx, [ebp + 0x264b8]
mov byte [ebp - 4], 1
call fcn.00403330
push str.Slation.exe
lea ecx, [ebp + 0x264b8]
mov byte [ebp - 4], 2
call fcn.00403470
push 0x206
lea eax, [ebp + 0x266b2]
push edi
push eax
mov word [ebp + 0x266b0], di
call fcn.0043db40
lea eax, [ebp + 0x26598]
push eax
lea eax, [ebp + 0x26560]
push eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x6c], edi
call fcn.0041ec8e
add esp, 0x14
push str.Temp.xml
lea ecx, [ebp + 0x26560]
mov byte [ebp - 4], 3
call fcn.0040b035
lea eax, [ebp + 0x26560]
push eax
lea eax, [ebp + 0x265b4]
push eax
call fcn.0041f360
pop ecx
pop ecx
cmp dword [ebp + 0x265cc], 8
mov eax, dword [ebp + 0x265b8]
mov byte [ebp - 4], 4
jae 0x42ff56
lea eax, [ebp + 0x265b8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp + 0x26598]
push eax
lea eax, [ebp + 0x2649c]
push eax
call fcn.0041ec8e
pop ecx
pop ecx
push str.Config.xml
lea ecx, [ebp + 0x2649c]
mov byte [ebp - 4], 5
call fcn.0040b035
lea eax, [ebp + 0x26598]
push eax
lea eax, [ebp + 0x264d4]
push eax
call fcn.0041ec8e
pop ecx
pop ecx
push str.temp.dat
lea ecx, [ebp + 0x264d4]
mov byte [ebp - 4], 6
call fcn.0040b035
lea ecx, [ebp - 0x278]
call fcn.0045eea0
push 0x38
mov byte [ebp - 4], 7
call fcn.00433c0b
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, edi
mov byte [ebp - 4], 8
je 0x42ffe9
push 0x4e3170
push 0x4cfecc
push 0x4cfec8
mov ecx, eax
call fcn.0045f2c0
jmp 0x42ffeb
xor eax, eax
push eax
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 7
call fcn.0045e3f0
push 0x50
call fcn.00433c0b
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, edi
mov byte [ebp - 4], 9
je 0x43001f
push str.TheQueryInfo
mov ecx, eax
call fcn.0045f7b0
mov dword [ebp - 0x38], eax
jmp 0x430022
mov dword [ebp - 0x38], edi
push 0x50
mov byte [ebp - 4], 7
call fcn.00433c0b
pop ecx
mov dword [ebp - 0x1c], eax
cmp eax, edi
mov byte [ebp - 4], 0xa
je 0x43004a
push str.PushList
mov ecx, eax
call fcn.0045f7b0
mov dword [ebp - 0x24], eax
jmp 0x43004d
mov dword [ebp - 0x24], edi
push str.anV6aWJyb3dzZQ
lea ecx, [ebp + 0x26544]
mov byte [ebp - 4], 7
call fcn.004015d0
sub esp, 0x1c
lea eax, [ebp + 0x26544]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
mov byte [ebp - 4], 0xb
call fcn.00403330
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp + 0x264f0]
push eax
call fcn.0042c403
push str.aGFvMTIza2FudHU
lea ecx, [ebp + 0x26544]
mov byte [ebp - 4], 0xc
call fcn.00403360
sub esp, 0x1c
lea eax, [ebp + 0x26544]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00403330
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp + 0x26528]
push eax
call fcn.0042c403
mov esi, dword [ebp + 0x268c4]
mov eax, dword [esi + 8]
add esi, 4
push esi
push eax
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x1c], esi
call fcn.0040d352
mov eax, dword [esi + 8]
push esi
jmp 0x4319fd
lea ecx, [ebp - 0x9c]
call fcn.0040d243
mov ebx, dword [eax + 0x1c]
push str.PushName
lea ecx, [ebp + 0x265d0]
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp + 0x265d0]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0xe
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x265d0]
mov byte [ebp - 4], 0xd
call fcn.004017a0
push str.ChooseInstall
lea ecx, [ebp + 0x265d0]
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp + 0x265d0]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0xf
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x265d0]
mov esi, eax
mov byte [ebp - 4], 0xd
call fcn.004017a0
cmp esi, edi
je 0x4319eb
cmp dword [esi + 0x18], 8
jb 0x430173
mov esi, dword [esi + 4]
jmp 0x430176
add esi, 4
push 0x4ca850
push esi
call fcn.0043ecda
test eax, eax
pop ecx
pop ecx
jne 0x4319eb
push str.PushName
lea ecx, [ebp + 0x265d0]
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp + 0x265d0]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x10
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x265d0]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0xd
call fcn.004017a0
push str.PushKeyName
lea ecx, [ebp - 0x1dc]
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp - 0x1dc]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x11
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x1dc]
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 0xd
call fcn.004017a0
push str.InstallPushUrl
lea ecx, [ebp + 0x26624]
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp + 0x26624]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x12
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x26624]
mov esi, eax
mov byte [ebp - 4], 0xd
call fcn.004017a0
push str.InstallPush32Url
lea ecx, [ebp + 0x26678]
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp + 0x26678]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x13
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x26678]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0xd
call fcn.004017a0
push str.InstallPush64Url
lea ecx, [ebp + 0x2665c]
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp + 0x2665c]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x14
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x2665c]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xd
call fcn.004017a0
push str.InstallProgramName
lea ecx, [ebp - 0x1f8]
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp - 0x1f8]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x15
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0xc0], eax
mov byte [ebp - 4], 0xd
call fcn.004017a0
push str.InstallAppDataName
lea ecx, [ebp - 0x134]
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp - 0x134]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x16
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x134]
mov dword [ebp - 0xc8], eax
mov byte [ebp - 4], 0xd
call fcn.004017a0
push str.InstallGreenBag
lea ecx, [ebp + 0x26694]
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp + 0x26694]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x17
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp + 0x26694]
mov dword [ebp - 0xac], eax
mov byte [ebp - 4], 0xd
call fcn.004017a0
push str.InstallRunParam
lea ecx, [ebp - 0x1a4]
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp - 0x1a4]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x18
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x1a4]
mov dword [ebp - 0x78], eax
mov byte [ebp - 4], 0xd
call fcn.004017a0
push str.InstallRunExe
lea ecx, [ebp - 0x214]
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp - 0x214]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x19
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x214]
mov dword [ebp - 0xb8], eax
mov byte [ebp - 4], 0xd
call fcn.004017a0
push str.InstallRunDll
lea ecx, [ebp - 0x188]
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp - 0x188]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1a
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x188]
mov dword [ebp - 0xc4], eax
mov byte [ebp - 4], 0xd
call fcn.004017a0
push str.InstallRunDllFnName
lea ecx, [ebp - 0x1c0]
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp - 0x1c0]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1b
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 0xd
call fcn.004017a0
push str.InstallTempName
lea ecx, [ebp - 0xf4]
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp - 0xf4]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1c
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 4], 0xd
call fcn.004017a0
push str.InstallRunAdmin
lea ecx, [ebp - 0x230]
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp - 0x230]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1d
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 0xd
call fcn.004017a0
push str.InstallRunLocalExe
lea ecx, [ebp - 0x16c]
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp - 0x16c]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1e
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0xa8], eax
mov byte [ebp - 4], 0xd
call fcn.004017a0
push str.InstallType
lea ecx, [ebp - 0x150]
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp - 0x150]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x1f
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x74], eax
mov byte [ebp - 4], 0xd
call fcn.004017a0
push str.InstallUACType
lea ecx, [ebp - 0x94]
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp - 0x94]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x20
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0xd
call fcn.004017a0
push str.InstallWmiMode
lea ecx, [ebp - 0x58]
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp - 0x58]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x21
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x58]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0xd
call fcn.004017a0
lea ecx, [ebp - 0x118]
call fcn.0040df13
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x22
call fcn.0040decb
test eax, eax
je 0x43059f
cmp dword [ebp - 0x14], edi
je 0x4305a7
mov esi, dword [ebp - 0x14]
jmp 0x4305a7
cmp dword [ebp - 0x10], edi
je 0x4305a7
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
cmp eax, edi
je 0x430874
cmp dword [eax + 0x18], 8
jb 0x4305c2
add eax, 4
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
jmp 0x4305c8
add eax, 4
mov dword [ebp - 0x10], eax
push str.zmbd
push eax
call fcn.0043ecda
test eax, eax
pop ecx
pop ecx
jne 0x4307ca
cmp dword [esi + 0x18], 8
jb 0x4305e8
mov esi, dword [esi + 4]
jmp 0x4305eb
add esi, 4
push esi
lea ecx, [ebp + 0x26694]
call fcn.004015d0
mov eax, dword [ebp + 0x26698]
push 8
pop esi
cmp dword [ebp + 0x266ac], esi
mov byte [ebp - 4], 0x23
jae 0x430612
lea eax, [ebp + 0x26698]
lea ecx, [ebp + 0x266b0]
push ecx
push eax
call fcn.0041db5f
pop ecx
pop ecx
lea eax, [ebp + 0x265ec]
push eax
lea ecx, [ebp + 0x26640]
call fcn.00403330
lea eax, [ebp + 0x266b0]
push eax
lea ecx, [ebp + 0x26640]
mov byte [ebp - 4], 0x24
call fcn.00403470
cmp dword [ebp + 0x26658], esi
mov eax, dword [ebp + 0x26644]
jae 0x43065d
lea eax, [ebp + 0x26644]
push eax
call fcn.0041efc6
pop ecx
lea ecx, [ebp - 0xd8]
call fcn.004013b0
cmp dword [ebp + 0x26604], esi
mov eax, dword [ebp + 0x265f0]
mov byte [ebp - 4], 0x25
jae 0x430687
lea eax, [ebp + 0x265f0]
push eax
lea ecx, [ebp - 0x94]
call fcn.004015d0
cmp dword [ebp + 0x266ac], esi
mov eax, dword [ebp + 0x26698]
mov byte [ebp - 4], 0x26
jae 0x4306ab
lea eax, [ebp + 0x26698]
push eax
lea ecx, [ebp - 0x58]
call fcn.004015d0
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x27
call fcn.00401450
movzx eax, al
xor esi, esi
push edi
inc esi
push esi
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x14], eax
call fcn.004017a0
push edi
push esi
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x25
call fcn.004017a0
cmp dword [ebp - 0x14], edi
lea ecx, [ebp - 0x94]
je 0x43071e
push 0x4ca850
call fcn.004015d0
push str.DownloadFlag
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x28
call fcn.004015d0
mov byte [ebp - 4], 0x29
jmp 0x43073d
push 0x4ca828
call fcn.004015d0
push str.DownloadFlag
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x2a
call fcn.004015d0
mov byte [ebp - 4], 0x2b
mov eax, dword [ebx]
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, ebx
call dword [eax + 8]
push edi
push esi
lea ecx, [ebp - 0x58]
call fcn.004017a0
push edi
push esi
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x25
call fcn.004017a0
cmp dword [ebp - 0x14], edi
je 0x4307a1
cmp dword [ebp + 0x26658], 8
mov eax, dword [ebp + 0x26644]
jae 0x430784
lea eax, [ebp + 0x26644]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, edi
je 0x4307a1
push str.DownloaderHelper
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x4307a1
call eax
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x24
call fcn.00401440
push edi
push esi
lea ecx, [ebp + 0x26640]
call fcn.004017a0
push edi
push esi
lea ecx, [ebp + 0x26694]
jmp 0x4319d7
cmp dword [ebp + 0x26540], 8
mov ecx, dword [ebp + 0x2652c]
jae 0x4307df
lea ecx, [ebp + 0x2652c]
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x18], 8
mov eax, dword [ebp - 0x10]
jb 0x4307ed
mov eax, dword [eax]
push ecx
push eax
call fcn.0043ecda
test eax, eax
pop ecx
pop ecx
jne 0x430840
cmp esi, edi
je 0x4319dc
lea ecx, [ebp + 0x26130]
call fcn.00432fd2
cmp dword [esi + 0x18], 8
mov byte [ebp - 4], 0x2c
jb 0x43081c
mov esi, dword [esi + 4]
jmp 0x43081f
add esi, 4
push esi
push ebx
lea ecx, [ebp + 0x26130]
call fcn.004336f6
lea ecx, [ebp + 0x26130]
mov byte [ebp - 4], 0x22
call fcn.00432e56
jmp 0x4319dc
cmp dword [ebp + 0x26508], 8
mov ecx, dword [ebp + 0x264f4]
jae 0x430855
lea ecx, [ebp + 0x264f4]
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x18], 8
mov eax, dword [ebp - 0x10]
jb 0x430863
mov eax, dword [eax]
push ecx
push eax
call fcn.0043ecda
test eax, eax
pop ecx
pop ecx
je 0x4319dc
cmp esi, edi
je 0x4319dc
cmp dword [esi + 0x18], 8
mov dword [ebp - 0x64], 1
jb 0x43088e
mov esi, dword [esi + 4]
jmp 0x430891
add esi, 4
push esi
lea ecx, [ebp + 0x26640]
call fcn.004015d0
mov eax, dword [ebp + 0x26644]
push 8
pop esi
cmp dword [ebp + 0x26658], esi
mov byte [ebp - 4], 0x2d
jae 0x4308b8
lea eax, [ebp + 0x26644]
lea ecx, [ebp + 0x266b0]
push ecx
push eax
call fcn.0041db5f
pop ecx
pop ecx
lea eax, [ebp + 0x265ec]
push eax
lea ecx, [ebp + 0x26608]
call fcn.00403330
lea eax, [ebp + 0x266b0]
push eax
lea ecx, [ebp + 0x26608]
mov byte [ebp - 4], 0x2e
call fcn.00403470
cmp dword [ebp + 0x26620], esi
mov eax, dword [ebp + 0x2660c]
jae 0x430903
lea eax, [ebp + 0x2660c]
push eax
call fcn.0041efc6
pop ecx
lea ecx, [ebp - 0xd0]
call fcn.004013b0
cmp dword [ebp + 0x26604], esi
mov eax, dword [ebp + 0x265f0]
mov byte [ebp - 4], 0x2f
jae 0x43092d
lea eax, [ebp + 0x265f0]
push eax
lea ecx, [ebp + 0x26678]
call fcn.004015d0
cmp dword [ebp + 0x26658], esi
mov eax, dword [ebp + 0x26644]
mov byte [ebp - 4], 0x30
jae 0x430951
lea eax, [ebp + 0x26644]
push eax
lea ecx, [ebp + 0x26624]
call fcn.004015d0
lea eax, [ebp + 0x26678]
push eax
lea eax, [ebp + 0x26624]
push eax
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x31
call fcn.00401450
movzx eax, al
xor esi, esi
push edi
inc esi
push esi
lea ecx, [ebp + 0x26624]
mov dword [ebp - 0x10], eax
call fcn.004017a0
push edi
push esi
lea ecx, [ebp + 0x26678]
mov byte [ebp - 4], 0x2f
call fcn.004017a0
cmp dword [ebp - 0x10], edi
jne 0x430ae3
lea eax, [ebp + 0x26640]
push eax
lea eax, [ebp + 0x26624]
push eax
mov dword [ebp - 0x10], esi
call fcn.0041ec8e
cmp dword [eax + 0x18], 0x10
pop ecx
pop ecx
jb 0x4309cd
mov eax, dword [eax + 4]
jmp 0x4309d0
add eax, 4
push eax
lea eax, [ebp + 0x25e30]
push eax
call fcn.0043ee00
pop ecx
pop ecx
push edi
push esi
lea ecx, [ebp + 0x26624]
call fcn.00401750
lea eax, [ebp + 0x265ec]
push eax
lea eax, [ebp + 0x26624]
push eax
call fcn.0041ec8e
cmp dword [eax + 0x18], 0x10
pop ecx
pop ecx
jb 0x430a0c
mov eax, dword [eax + 4]
jmp 0x430a0f
add eax, 4
push eax
lea eax, [ebp + 0x26030]
push eax
call fcn.0043ee00
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp + 0x26624]
call fcn.00401750
lea ecx, [ebp]
call fcn.00427b92
sub esp, 0x300
mov edi, esp
mov ecx, 0xc0
lea esi, [ebp + 0x25e30]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp]
mov byte [ebp - 4], 0x32
call fcn.0042845a
lea ecx, [ebp]
call fcn.004281a2
lea ecx, [ebp + 0x26184]
call fcn.00427b53
lea ecx, [ebp]
call fcn.00427bf0
test eax, eax
je 0x430a8c
lea eax, [ebp + 0x26184]
push eax
lea ecx, [ebp]
call fcn.0042809b
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp]
call fcn.00427bfc
test eax, eax
je 0x430a69
lea eax, [ebp + 0x26184]
push eax
lea ecx, [ebp]
call fcn.0042809b
fld qword [ebp + 0x2648c]
fcomp qword [ebp + 0x26494]
fnstsw ax
test ah, 0x44
jp 0x430ac9
fldz
fcomp qword [ebp + 0x26494]
fnstsw ax
test ah, 0x44
jp 0x430acd
and dword [ebp - 0x10], 0
lea ecx, [ebp]
mov byte [ebp - 4], 0x2f
call fcn.00427beb
cmp dword [ebp - 0x10], 0
je 0x430ba1
push 0x4ca850
lea ecx, [ebp + 0x26678]
call fcn.004015d0
push str.DownloadFlag
lea ecx, [ebp + 0x26624]
mov byte [ebp - 4], 0x33
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp + 0x26678]
push ecx
lea ecx, [ebp + 0x26624]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x34
call dword [eax + 8]
xor edi, edi
push edi
push 1
lea ecx, [ebp + 0x26624]
call fcn.004017a0
push edi
push 1
lea ecx, [ebp + 0x26678]
mov byte [ebp - 4], 0x2f
call fcn.004017a0
mov eax, dword [ebp - 0x20]
push 8
pop esi
cmp dword [eax + 0x18], esi
jb 0x430b52
mov eax, dword [eax + 4]
jmp 0x430b55
add eax, 4
push str.alimama
push eax
call fcn.0043ecda
test eax, eax
pop ecx
pop ecx
jne 0x430c05
lea eax, [ebp - 0x68]
push eax
push 0xf003f
push edi
push str.Software
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x430c05
push str.AlimamaShortcuts
push dword [ebp - 0x68]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x430c05
push 0x4ca828
lea ecx, [ebp + 0x26624]
call fcn.004015d0
push str.DownloadFlag
lea ecx, [ebp + 0x265d0]
mov byte [ebp - 4], 0x35
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp + 0x26624]
push ecx
lea ecx, [ebp + 0x265d0]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x36
call dword [eax + 8]
push 0
push 1
lea ecx, [ebp + 0x265d0]
call fcn.004017a0
push 0
push 1
lea ecx, [ebp + 0x26624]
mov byte [ebp - 4], 0x2f
call fcn.004017a0
push 8
xor edi, edi
pop esi
cmp dword [ebp + 0x26604], esi
mov ecx, dword [ebp + 0x265f0]
jae 0x430c19
lea ecx, [ebp + 0x265f0]
cmp dword [ebp + 0x26658], esi
mov eax, dword [ebp + 0x26644]
jae 0x430c2d
lea eax, [ebp + 0x26644]
push dword [ebp - 0x10]
push ecx
push eax
push str.__s___s___d_
call fcn.00420658
add esp, 0x10
cmp dword [ebp - 0x10], edi
je 0x4319b1
cmp dword [ebp + 0x26604], esi
mov eax, dword [ebp + 0x265f0]
jae 0x430c5c
lea eax, [ebp + 0x265f0]
push eax
lea ecx, [ebp + 0x2665c]
call fcn.004015d0
lea eax, [ebp + 0x266b0]
push eax
lea ecx, [ebp + 0x26624]
mov byte [ebp - 4], 0x37
call fcn.004015d0
mov eax, dword [ebp - 0xac]
cmp eax, edi
mov byte [ebp - 4], 0x38
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
je 0x430ece
cmp dword [eax + 0x18], esi
jb 0x430ca0
mov eax, dword [eax + 4]
jmp 0x430ca3
add eax, 4
push 0x4ca850
push eax
call fcn.0043ecda
test eax, eax
pop ecx
pop ecx
jne 0x430ece
push 0x4e3194
lea ecx, [ebp + 0x26694]
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x64], edi
call fcn.004015d0
mov esi, dword [ebp - 0xc0]
cmp esi, edi
mov byte [ebp - 4], 0x39
je 0x430d01
push 0x206
lea eax, [ebp + 0x26296]
push edi
push eax
mov word [ebp + 0x26294], di
call fcn.0043db40
add esp, 0xc
push edi
push 0x26
jmp 0x430d2a
mov esi, dword [ebp - 0xc8]
cmp esi, edi
je 0x430d5c
push 0x206
lea eax, [ebp + 0x26296]
push edi
push eax
mov word [ebp + 0x26294], di
call fcn.0043db40
add esp, 0xc
push edi
push 0x1a
lea eax, [ebp + 0x26294]
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp + 0x26294]
push eax
lea ecx, [ebp + 0x26694]
call fcn.00403360
push 0x4e3174
lea ecx, [ebp + 0x26694]
call fcn.00403470
jmp 0x430da6
mov esi, dword [ebp - 0xbc]
cmp esi, edi
je 0x430dd2
push 0x206
lea eax, [ebp + 0x26296]
push edi
push eax
mov word [ebp + 0x26294], di
call fcn.0043db40
add esp, 0xc
lea eax, [ebp + 0x26294]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp + 0x26294]
push eax
lea ecx, [ebp + 0x26694]
call fcn.00403360
cmp dword [esi + 0x18], 8
jb 0x430db1
mov esi, dword [esi + 4]
jmp 0x430db4
add esi, 4
push esi
lea ecx, [ebp + 0x26694]
call fcn.00403470
push 0x4e3174
lea ecx, [ebp + 0x26694]
call fcn.00403470
jmp 0x430dea
call fcn.0040d288
mov ecx, eax
call fcn.0040b07f
push eax
lea ecx, [ebp + 0x26694]
call fcn.00403360
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26694]
push eax
lea ecx, [ebp + 0x2665c]
call fcn.00401d10
cmp dword [ebp + 0x26604], 8
mov eax, dword [ebp + 0x265f0]
jae 0x430e14
lea eax, [ebp + 0x265f0]
push eax
lea ecx, [ebp + 0x26678]
call fcn.004015d0
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26624]
push eax
lea ecx, [ebp + 0x26678]
mov byte [ebp - 4], 0x3a
call fcn.004038f0
lea eax, [ebp + 0x26678]
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.0041ec8e
pop ecx
pop ecx
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0x3b
jb 0x430e5d
mov eax, dword [eax + 4]
jmp 0x430e60
add eax, 4
cmp dword [ebp + 0x266ac], 8
mov ecx, dword [ebp + 0x26698]
jae 0x430e75
lea ecx, [ebp + 0x26698]
push edi
push edi
push eax
push ecx
call fcn.0040962b
add esp, 0x10
push edi
push 1
lea ecx, [ebp - 0xf4]
call fcn.00401750
cmp dword [ebp + 0x26690], 8
mov eax, dword [ebp + 0x2667c]
jae 0x430ea4
lea eax, [ebp + 0x2667c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push 1
lea ecx, [ebp + 0x26678]
call fcn.004017a0
push edi
push 1
lea ecx, [ebp + 0x26694]
mov byte [ebp - 4], 0x38
call fcn.004017a0
push 8
pop esi
mov eax, dword [ebp - 0xb8]
cmp eax, edi
je 0x430f9b
cmp dword [eax + 0x18], esi
jb 0x430ee6
mov eax, dword [eax + 4]
jmp 0x430ee9
add eax, 4
push eax
lea ecx, [ebp + 0x26624]
call fcn.00403360
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26624]
push eax
lea ecx, [ebp + 0x2665c]
call fcn.004038f0
cmp dword [ebp - 0x14], edi
jne 0x431313
cmp dword [ebp + 0x26674], esi
mov ecx, dword [ebp + 0x26660]
jae 0x430f27
lea ecx, [ebp + 0x26660]
cmp dword [ebp + 0x26620], esi
mov eax, dword [ebp + 0x2660c]
jae 0x430f3b
lea eax, [ebp + 0x2660c]
push ecx
push eax
call fcn.0041dc7f
cmp dword [ebp + 0x26674], esi
pop ecx
pop ecx
mov ecx, dword [ebp + 0x26660]
jae 0x430f58
lea ecx, [ebp + 0x26660]
cmp dword [ebp + 0x26620], esi
mov eax, dword [ebp + 0x2660c]
jae 0x430f6c
lea eax, [ebp + 0x2660c]
push ecx
push eax
push str.__s___s_
call fcn.00420658
mov eax, dword [ebp + 0x2660c]
add esp, 0xc
cmp dword [ebp + 0x26620], esi
jae 0x430f8f
lea eax, [ebp + 0x2660c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x431313
mov eax, dword [ebp - 0xc4]
cmp eax, edi
je 0x431301
cmp dword [eax + 0x18], esi
mov dword [ebp - 0x10], 1
jb 0x430fba
mov eax, dword [eax + 4]
jmp 0x430fbd
add eax, 4
push eax
lea ecx, [ebp + 0x26624]
call fcn.00403360
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26624]
push eax
lea ecx, [ebp + 0x2665c]
call fcn.004038f0
cmp dword [ebp - 0x14], edi
jne 0x43106a
cmp dword [ebp + 0x26674], esi
mov ecx, dword [ebp + 0x26660]
jae 0x430ffb
lea ecx, [ebp + 0x26660]
cmp dword [ebp + 0x26620], esi
mov eax, dword [ebp + 0x2660c]
jae 0x43100f
lea eax, [ebp + 0x2660c]
push ecx
push eax
call fcn.0041dc7f
cmp dword [ebp + 0x26674], esi
pop ecx
pop ecx
mov ecx, dword [ebp + 0x26660]
jae 0x43102c
lea ecx, [ebp + 0x26660]
cmp dword [ebp + 0x26620], esi
mov eax, dword [ebp + 0x2660c]
jae 0x431040
lea eax, [ebp + 0x2660c]
push ecx
push eax
push str.__s___s_
call fcn.00420658
mov eax, dword [ebp + 0x2660c]
add esp, 0xc
cmp dword [ebp + 0x26620], esi
jae 0x431063
lea eax, [ebp + 0x2660c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x74]
cmp eax, edi
je 0x431096
cmp dword [eax + 0x18], esi
jb 0x43107b
mov eax, dword [eax + 4]
jmp 0x43107e
add eax, 4
push 0x4cfc10
push eax
call fcn.0043ecda
test eax, eax
pop ecx
pop ecx
jne 0x431096
mov dword [ebp - 0x30], 1
lea eax, [ebp + 0x2665c]
push eax
lea ecx, [ebp + 0x265d0]
call fcn.00403330
mov ecx, dword [ebp - 0x3c]
lea eax, [ebp + 0x26678]
push eax
mov byte [ebp - 4], 0x3c
call fcn.0042fd45
push 0x4e3194
lea ecx, [ebp + 0x26694]
mov byte [ebp - 4], 0x3d
call fcn.004015d0
mov esi, dword [ebp - 0x2c]
push 0xffffffffffffffff
lea eax, [ebp + 0x265d0]
push edi
lea ecx, [ebp + 0x26694]
push eax
mov byte [ebp - 4], 0x3e
call fcn.00401d10
cmp esi, edi
je 0x431119
push 0x4cfc0c
lea ecx, [ebp + 0x26694]
call fcn.00403470
cmp dword [esi + 0x18], 8
jb 0x43110a
mov esi, dword [esi + 4]
jmp 0x43110d
add esi, 4
push esi
lea ecx, [ebp + 0x26694]
call fcn.00403470
cmp dword [ebp + 0x266ac], 8
mov ecx, dword [ebp + 0x26698]
jae 0x43112e
lea ecx, [ebp + 0x26698]
cmp dword [ebp + 0x26690], 8
mov eax, dword [ebp + 0x2667c]
jae 0x431143
lea eax, [ebp + 0x2667c]
push ecx
push eax
lea eax, [ebp + 0x25f28]
push 0x4ca648
push eax
call fcn.0043ec44
add esp, 0x10
cmp dword [ebp - 0x30], edi
je 0x4312c4
push 0x50
call fcn.00433c0b
pop ecx
mov dword [ebp - 0x2c], eax
cmp eax, edi
mov byte [ebp - 4], 0x3f
je 0x431186
push str.PushItem
mov ecx, eax
call fcn.0045f7b0
mov dword [ebp - 0x20], eax
jmp 0x431189
mov dword [ebp - 0x20], edi
push 0x50
mov byte [ebp - 4], 0x3e
call fcn.00433c0b
pop ecx
mov dword [ebp - 0x2c], eax
cmp eax, edi
mov byte [ebp - 4], 0x40
je 0x4311b0
push 0x4cfbf0
mov ecx, eax
call fcn.0045f7b0
mov esi, eax
jmp 0x4311b2
xor esi, esi
push 0x1f3
lea eax, [ebp + 0x262a9]
push edi
push eax
mov byte [ebp - 4], 0x3e
mov byte [ebp + 0x262a8], 0
call fcn.0043db40
mov eax, dword [ebp + 0x2667c]
add esp, 0xc
cmp dword [ebp + 0x26690], 8
jae 0x4311e7
lea eax, [ebp + 0x2667c]
lea ecx, [ebp + 0x262a8]
push ecx
push eax
call fcn.0041d4ba
push 0x30
call fcn.00433c0b
add esp, 0xc
mov dword [ebp - 0x2c], eax
cmp eax, edi
mov byte [ebp - 4], 0x41
je 0x431219
lea ecx, [ebp + 0x262a8]
push ecx
mov ecx, eax
call fcn.0042edd3
jmp 0x43121b
xor eax, eax
push eax
mov ecx, esi
mov byte [ebp - 4], 0x3e
call fcn.0045e3f0
mov ecx, dword [ebp - 0x20]
push esi
call fcn.0045e3f0
push 0x50
call fcn.00433c0b
pop ecx
mov dword [ebp - 0x2c], eax
cmp eax, edi
mov byte [ebp - 4], 0x42
je 0x431253
push 0x4cfbe0
mov ecx, eax
call fcn.0045f7b0
mov esi, eax
jmp 0x431255
xor esi, esi
cmp dword [ebp + 0x266ac], 8
mov eax, dword [ebp + 0x26698]
mov byte [ebp - 4], 0x3e
jae 0x43126e
lea eax, [ebp + 0x26698]
lea ecx, [ebp + 0x262a8]
push ecx
push eax
call fcn.0041d4ba
push 0x30
call fcn.00433c0b
add esp, 0xc
mov dword [ebp - 0x2c], eax
cmp eax, edi
mov byte [ebp - 4], 0x43
je 0x4312a0
lea ecx, [ebp + 0x262a8]
push ecx
mov ecx, eax
call fcn.0042edd3
jmp 0x4312a2
xor eax, eax
push eax
mov ecx, esi
mov byte [ebp - 4], 0x3e
call fcn.0045e3f0
mov ecx, dword [ebp - 0x20]
push esi
call fcn.0045e3f0
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
call fcn.0045e3f0
jmp 0x4312d1
lea eax, [ebp + 0x25f28]
push eax
call fcn.0041e61a
pop ecx
push edi
push 1
lea ecx, [ebp + 0x26694]
call fcn.004017a0
push edi
push 1
lea ecx, [ebp + 0x26678]
call fcn.004017a0
push edi
push 1
lea ecx, [ebp + 0x265d0]
mov byte [ebp - 4], 0x38
call fcn.004017a0
jmp 0x431313
lea eax, [ebp + 0x266b0]
push eax
lea ecx, [ebp + 0x2665c]
call fcn.00403470
mov esi, dword [ebp - 0xa8]
cmp esi, edi
je 0x43134c
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26598]
push eax
lea ecx, [ebp + 0x2665c]
call fcn.00401d10
cmp dword [esi + 0x18], 8
jb 0x43133d
mov esi, dword [esi + 4]
jmp 0x431340
add esi, 4
push esi
lea ecx, [ebp + 0x2665c]
call fcn.00403470
cmp dword [ebp - 0x10], edi
jne 0x431995
push 0x4e3194
lea ecx, [ebp + 0x26694]
call fcn.004015d0
mov esi, dword [ebp - 0x78]
cmp esi, edi
mov byte [ebp - 4], 0x44
lea ecx, [ebp + 0x26694]
jne 0x431387
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x2665c]
push eax
call fcn.004038f0
jmp 0x4313d0
push 0x4caf54
call fcn.00403470
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x2665c]
push eax
lea ecx, [ebp + 0x26694]
call fcn.004038f0
push 0x4cc60c
lea ecx, [ebp + 0x26694]
call fcn.00403470
cmp dword [esi + 0x18], 8
jb 0x4313c1
mov esi, dword [esi + 4]
jmp 0x4313c4
add esi, 4
push esi
lea ecx, [ebp + 0x26694]
call fcn.00403470
mov esi, dword [ebp - 0x74]
cmp esi, edi
je 0x4316da
mov eax, dword [ebp - 0xa0]
cmp eax, edi
je 0x43140b
cmp dword [eax + 0x18], 8
jb 0x4313f0
mov eax, dword [eax + 4]
jmp 0x4313f3
add eax, 4
push 0x4ca850
push eax
call fcn.0043ecda
test eax, eax
pop ecx
pop ecx
jne 0x43140b
mov dword [ebp - 0x6c], 1
cmp dword [esi + 0x18], 8
jb 0x431416
mov eax, dword [esi + 4]
jmp 0x431419
lea eax, [esi + 4]
push 0x4cfc10
push eax
call fcn.0043ecda
test eax, eax
pop ecx
pop ecx
jne 0x4316da
call fcn.0041df3f
test eax, eax
je 0x43147f
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x43147f
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x43144b
mov eax, dword [edi]
jmp 0x43144d
mov eax, edi
push str.direct_open
push eax
call fcn.0043ecda
test eax, eax
pop ecx
pop ecx
je 0x4316d8
cmp dword [esi + 0x18], 8
jb 0x43146a
mov edi, dword [edi]
push str.no_open
push edi
call fcn.0043ecda
test eax, eax
pop ecx
pop ecx
je 0x43195f
push 0x50
pop edi
push edi
mov dword [ebp - 0x30], 1
call fcn.00433c0b
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x45
je 0x4314ac
push str.PushItem
mov ecx, eax
call fcn.0045f7b0
mov dword [ebp - 0x10], eax
jmp 0x4314b0
and dword [ebp - 0x10], 0
push edi
mov byte [ebp - 4], 0x44
call fcn.00433c0b
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x46
je 0x4314d6
push 0x4cfbf0
mov ecx, eax
call fcn.0045f7b0
mov esi, eax
jmp 0x4314d8
xor esi, esi
push 0x1f3
lea eax, [ebp + 0x262a9]
push 0
push eax
mov byte [ebp - 4], 0x44
mov byte [ebp + 0x262a8], 0
call fcn.0043db40
mov eax, dword [ebp + 0x26660]
add esp, 0xc
cmp dword [ebp + 0x26674], 8
jae 0x43150e
lea eax, [ebp + 0x26660]
lea ecx, [ebp + 0x262a8]
push ecx
push eax
call fcn.0041d4ba
push 0x30
pop ebx
push ebx
call fcn.00433c0b
add esp, 0xc
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x47
je 0x431542
lea ecx, [ebp + 0x262a8]
push ecx
mov ecx, eax
call fcn.0042edd3
jmp 0x431544
xor eax, eax
push eax
mov ecx, esi
mov byte [ebp - 4], 0x44
call fcn.0045e3f0
mov ecx, dword [ebp - 0x10]
push esi
call fcn.0045e3f0
push edi
call fcn.00433c0b
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x48
je 0x43157b
push 0x4cfbe0
mov ecx, eax
call fcn.0045f7b0
mov esi, eax
jmp 0x43157d
xor esi, esi
mov eax, dword [ebp - 0x78]
test eax, eax
mov byte [ebp - 4], 0x44
je 0x4315de
cmp dword [eax + 0x18], 8
jb 0x431593
mov eax, dword [eax + 4]
jmp 0x431596
add eax, 4
lea ecx, [ebp + 0x262a8]
push ecx
push eax
call fcn.0041d4ba
push ebx
call fcn.00433c0b
add esp, 0xc
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x49
je 0x4315c7
lea ecx, [ebp + 0x262a8]
push ecx
mov ecx, eax
call fcn.0042edd3
jmp 0x4315c9
xor eax, eax
push eax
mov ecx, esi
mov byte [ebp - 4], 0x44
call fcn.0045e3f0
mov ecx, dword [ebp - 0x10]
push esi
call fcn.0045e3f0
cmp dword [ebp - 0x14], 0
jne 0x431643
push edi
call fcn.00433c0b
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x4a
je 0x431606
push str.InstallReBootDel
mov ecx, eax
call fcn.0045f7b0
mov esi, eax
jmp 0x431608
xor esi, esi
push ebx
mov byte [ebp - 4], 0x44
call fcn.00433c0b
pop ecx
mov dword [ebp - 0x28], eax
test eax, eax
mov byte [ebp - 4], 0x4b
je 0x43162c
push str.true
mov ecx, eax
call fcn.0042edd3
jmp 0x43162e
xor eax, eax
push eax
mov ecx, esi
mov byte [ebp - 4], 0x44
call fcn.0045e3f0
mov ecx, dword [ebp - 0x10]
push esi
call fcn.0045e3f0
mov esi, dword [ebp - 0x34]
test esi, esi
je 0x4316c8
push edi
call fcn.00433c0b
pop ecx
mov dword [ebp - 0x34], eax
test eax, eax
mov byte [ebp - 4], 0x4c
je 0x43166c
push 0x4cfb94
mov ecx, eax
call fcn.0045f7b0
mov edi, eax
jmp 0x43166e
xor edi, edi
cmp dword [esi + 0x18], 8
mov byte [ebp - 4], 0x44
jb 0x43167d
mov eax, dword [esi + 4]
jmp 0x431680
lea eax, [esi + 4]
lea ecx, [ebp + 0x262a8]
push ecx
push eax
call fcn.0041d4ba
push ebx
call fcn.00433c0b
add esp, 0xc
mov dword [ebp - 0x34], eax
test eax, eax
mov byte [ebp - 4], 0x4d
je 0x4316b1
lea ecx, [ebp + 0x262a8]
push ecx
mov ecx, eax
call fcn.0042edd3
jmp 0x4316b3
xor eax, eax
push eax
mov ecx, edi
mov byte [ebp - 4], 0x44
call fcn.0045e3f0
mov ecx, dword [ebp - 0x10]
push edi
call fcn.0045e3f0
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
call fcn.0045e3f0
jmp 0x43195f
xor edi, edi
mov esi, dword [ebp - 0x60]
cmp esi, edi
je 0x431921
cmp dword [esi + 0x18], 8
jb 0x4316f0
mov eax, dword [esi + 4]
jmp 0x4316f3
lea eax, [esi + 4]
push 0x4cfac4
push eax
call fcn.0043ecda
test eax, eax
pop ecx
pop ecx
jne 0x4317e3
lea ecx, [ebp - 0x5c]
call fcn.00424d15
push str.InstallConfig1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x4e
call fcn.004015d0
lea ecx, [ebx + 0x18]
mov eax, dword [ecx]
lea edx, [ebp - 0x58]
push edx
mov byte [ebp - 4], 0x4f
call dword [eax + 0x1c]
push edi
push 1
lea ecx, [ebp - 0x58]
mov esi, eax
mov byte [ebp - 4], 0x4e
call fcn.004017a0
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x43174f
mov eax, dword [edi]
jmp 0x431751
mov eax, edi
push eax
push str.FID:_s
call fcn.00420658
cmp dword [esi + 0x18], 8
pop ecx
pop ecx
jb 0x431766
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x5c]
call fcn.0042cb62
push str.FID_end
mov esi, eax
call fcn.00420658
test esi, esi
pop ecx
je 0x4317d2
push 0x4ca850
lea ecx, [ebp - 0x94]
call fcn.004015d0
push str.InstallFlag
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x50
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x51
call dword [eax + 8]
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.004017a0
push 0
push 1
lea ecx, [ebp - 0x94]
call fcn.004017a0
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x44
call fcn.0042c3a7
mov esi, dword [ebp - 0x60]
xor edi, edi
cmp dword [esi + 0x18], 8
lea eax, [esi + 4]
mov dword [ebp - 0x14], eax
jb 0x4317f1
mov eax, dword [eax]
push str.greenbaggame
push eax
call fcn.0043ecda
test eax, eax
pop ecx
pop ecx
jne 0x431835
lea ecx, [ebp - 0x15]
call sym.setup_Clover.exe_public:_class_DuiLib::CMarkup____thiscall_DuiLib::CDialogBuilder::GetMarkup_void_
lea eax, [ebx + 0x18]
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x15]
mov byte [ebp - 4], 0x52
call fcn.0042e0da
push edi
push 1
lea ecx, [ebp - 0x58]
call fcn.004017a0
lea ecx, [ebp - 0x15]
mov byte [ebp - 4], 0x44
call sym.setup_Clover.exe_void___cdecl_DuiLib::DUI__Trace_wchar_t_const__
cmp dword [esi + 0x18], 8
mov eax, dword [ebp - 0x14]
jb 0x431840
mov eax, dword [eax]
push 0x4cfabc
push eax
call fcn.0043ecda
test eax, eax
pop ecx
pop ecx
jne 0x43195f
lea ecx, [ebp - 0x70]
call fcn.00424d15
push str.InstallConfig1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x53
call fcn.004015d0
lea ecx, [ebx + 0x18]
mov eax, dword [ecx]
lea edx, [ebp - 0x58]
push edx
mov byte [ebp - 4], 0x54
call dword [eax + 0x1c]
push 0
push 1
lea ecx, [ebp - 0x58]
mov esi, eax
mov byte [ebp - 4], 0x53
call fcn.004017a0
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x43189d
mov eax, dword [edi]
jmp 0x43189f
mov eax, edi
push eax
push str.lock:_s
call fcn.00420658
cmp dword [esi + 0x18], 8
pop ecx
pop ecx
jb 0x4318b4
mov edi, dword [edi]
push edi
lea ecx, [ebp - 0x70]
call fcn.0042c785
test eax, eax
je 0x431913
push 0x4ca850
lea ecx, [ebp - 0x94]
call fcn.004015d0
push str.InstallFlag
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x55
call fcn.004015d0
mov eax, dword [ebx]
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [ebp - 0x58]
push ecx
mov ecx, ebx
mov byte [ebp - 4], 0x56
call dword [eax + 8]
push 0
push 1
lea ecx, [ebp - 0x58]
call fcn.004017a0
push 0
push 1
lea ecx, [ebp - 0x94]
call fcn.004017a0
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x44
call fcn.0042c3a7
jmp 0x43195f
cmp dword [ebp + 0x266ac], 8
mov eax, dword [ebp + 0x26698]
jae 0x431936
lea eax, [ebp + 0x26698]
push eax
call fcn.0041e61a
cmp dword [ebp + 0x266ac], 8
mov eax, dword [ebp + 0x26698]
pop ecx
jae 0x431952
lea eax, [ebp + 0x26698]
push eax
push 0x4ca39c
call fcn.00420658
pop ecx
pop ecx
xor esi, esi
cmp dword [ebp - 0x64], esi
je 0x431985
cmp dword [ebp + 0x26674], 8
mov eax, dword [ebp + 0x26660]
jae 0x43197b
lea eax, [ebp + 0x26660]
push 5
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push esi
push 1
lea ecx, [ebp + 0x26694]
call fcn.004017a0
xor edi, edi
push edi
push 1
lea ecx, [ebp + 0x26624]
call fcn.004017a0
push edi
push 1
lea ecx, [ebp + 0x2665c]
call fcn.004017a0
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 0x2e
call fcn.00401440
push edi
push 1
lea ecx, [ebp + 0x26608]
call fcn.004017a0
push edi
push 1
lea ecx, [ebp + 0x26640]
call fcn.004017a0
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0xd
call fcn.0040ddee
lea ecx, [ebp - 0x9c]
call fcn.0040d264
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + 8]
push ecx
push eax
lea ecx, [ebp - 0xb4]
call fcn.0040d352
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x9c]
call fcn.0040e0bd
test al, al
je 0x4300e8
push dword [ebp - 0x24]
mov ecx, dword [ebp - 0x38]
call fcn.0045e3f0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x278]
call fcn.0045e3f0
cmp dword [ebp + 0x26578], 0x10
mov eax, dword [ebp + 0x26564]
jae 0x431a51
lea eax, [ebp + 0x26564]
push eax
lea ecx, [ebp - 0x278]
call fcn.0045ef50
cmp dword [ebp + 0x265cc], 8
mov eax, dword [ebp + 0x265b8]
mov dword [ebp - 0x10], edi
jae 0x431a75
lea eax, [ebp + 0x265b8]
push edi
push 0x80
push 4
push edi
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x431a9e
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
inc esi
push esi
call fcn.00433c36
push esi
push edi
push eax
mov dword [ebp - 0x24], eax
call fcn.0043db40
add esp, 0x10
push edi
lea eax, [ebp - 0xa4]
push eax
push esi
push dword [ebp - 0x24]
mov dword [ebp - 0xa4], edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp + 0x2649c]
push eax
lea eax, [ebp + 0x2650c]
push eax
call fcn.0041f360
pop ecx
pop ecx
cmp dword [ebp + 0x265cc], 8
mov eax, dword [ebp + 0x265b8]
mov byte [ebp - 4], 0x57
jae 0x431b04
lea eax, [ebp + 0x265b8]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
push str.GUANGSU
call fcn.0043e020
pop ecx
xor ecx, ecx
xor edx, edx
cmp dword [ebp - 0x10], edi
mov dword [ebp - 0x1c], eax
jle 0x431b3f
mov eax, dword [ebp - 0x24]
mov bl, byte [ecx + str.GUANGSU]
add eax, edx
xor byte [eax], bl
inc ecx
cmp ecx, dword [ebp - 0x1c]
jl 0x431b39
xor ecx, ecx
inc edx
cmp edx, dword [ebp - 0x10]
jl 0x431b24
cmp dword [ebp + 0x26524], 8
mov eax, dword [ebp + 0x26510]
jae 0x431b54
lea eax, [ebp + 0x26510]
push eax
call esi
lea eax, [ebp + 0x264d4]
push eax
lea eax, [ebp + 0x2657c]
push eax
call fcn.0041f360
pop ecx
pop ecx
cmp dword [ebp + 0x26594], 8
mov eax, dword [ebp + 0x26580]
mov byte [ebp - 4], 0x58
jae 0x431b85
lea eax, [ebp + 0x26580]
push eax
call fcn.0041efc6
cmp dword [ebp + 0x26594], 8
mov eax, dword [ebp + 0x26580]
pop ecx
jae 0x431ba1
lea eax, [ebp + 0x26580]
push edi
push 0x80
xor esi, esi
inc esi
push esi
push edi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x431bdc
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], edi
push dword [ebp - 0x24]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x30], edi
je 0x431d35
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, 0x4e3194
push esi
lea ecx, [ebp + 0x26624]
call fcn.004015d0
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26598]
push eax
lea ecx, [ebp + 0x26624]
mov byte [ebp - 4], 0x59
call fcn.00401d10
push str.Util32.exe
lea ecx, [ebp + 0x26624]
call fcn.00403470
push esi
lea ecx, [ebp + 0x26678]
call fcn.004015d0
mov ebx, 0x4caf54
push ebx
lea ecx, [ebp + 0x26678]
mov byte [ebp - 4], 0x5a
call fcn.00403360
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26624]
push eax
lea ecx, [ebp + 0x26678]
call fcn.004038f0
push str.__UnVuSW50ZXJmYWNl
lea ecx, [ebp + 0x26678]
call fcn.00403470
cmp dword [ebp - 0x6c], edi
jne 0x431c96
cmp dword [ebp + 0x26690], 8
mov eax, dword [ebp + 0x2667c]
jae 0x431c8a
lea eax, [ebp + 0x2667c]
push eax
call fcn.0041e61a
pop ecx
jmp 0x431d16
push esi
lea ecx, [ebp + 0x26640]
call fcn.004015d0
push ebx
lea ecx, [ebp + 0x26640]
mov byte [ebp - 4], 0x5b
call fcn.00403360
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x264b8]
push eax
lea ecx, [ebp + 0x26640]
call fcn.004038f0
push 0x4cc60c
lea ecx, [ebp + 0x26640]
call fcn.00403470
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x26624]
push eax
lea ecx, [ebp + 0x26640]
call fcn.004038f0
cmp dword [ebp + 0x26658], 8
mov eax, dword [ebp + 0x26644]
jae 0x431d01
lea eax, [ebp + 0x26644]
push eax
call fcn.0041e61a
pop ecx
push edi
push 1
lea ecx, [ebp + 0x26640]
call fcn.004017a0
push edi
push 1
lea ecx, [ebp + 0x26678]
call fcn.004017a0
push edi
push 1
lea ecx, [ebp + 0x26624]
call fcn.004017a0
xor esi, esi
inc esi
push dword [ebp - 0x24]
call fcn.004ba1f0
pop ecx
push edi
push esi
lea ecx, [ebp + 0x2657c]
call fcn.004017a0
push edi
push esi
lea ecx, [ebp + 0x2650c]
call fcn.004017a0
push edi
push esi
lea ecx, [ebp + 0x26528]
call fcn.004017a0
push edi
push esi
lea ecx, [ebp + 0x264f0]
call fcn.004017a0
push edi
push esi
lea ecx, [ebp + 0x26544]
call fcn.004017a0
lea ecx, [ebp - 0x278]
mov byte [ebp - 4], 6
call fcn.0040e30f
push edi
push esi
lea ecx, [ebp + 0x264d4]
call fcn.00401750
push edi
push esi
lea ecx, [ebp + 0x2649c]
call fcn.00401750
push edi
push esi
lea ecx, [ebp + 0x265b4]
call fcn.004017a0
push edi
push esi
lea ecx, [ebp + 0x26560]
call fcn.00401750
push edi
push esi
lea ecx, [ebp + 0x264b8]
call fcn.004017a0
push edi
push esi
lea ecx, [ebp + 0x265ec]
call fcn.004017a0
push edi
push esi
lea ecx, [ebp + 0x26598]
call fcn.004017a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x268b8]
xor ecx, ebp
call fcn.0043db25
add ebp, 0x268bc
leave
ret 4