Function at 0x409124
Capabilities:
Check mutex on windows
Copy file
Create process on windows
Delete directory
Delete file
Log keystrokes via polling
Resolve function by parsing pe exports
Self delete

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46afec
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push ebx
push esi
push edi
mov eax, dword [0x485060]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
lea eax, [esp + 0x34]
push eax
call fcn.004021f9
xor edi, edi
mov dword [esp + 0xc0], edi
mov dword [esp + 0x38], 1
push 0xfffffffffffffffe
pop eax
cmp dword [esi + 0x5a8], edi
je 0x4091a6
or dword [esp + 0x3c], 0xffffffff
lea eax, [esp + 0x3c]
push eax
push dword [esp + 0x34]
lea eax, [esi + 0x5ac]
push eax
mov dword [esp + 0x44], edi
call fcn.00436d75
mov eax, dword [esp + 0x3c]
add eax, 2
cmp eax, 0x54
ja case.default.0x4091b2
jmp dword [eax*4 + 0x40b2fc]
cmp dword [esi + 0x5a8], edi
jne 0x409e47
mov esi, dword [ebp + 8]
push str.StartInstall_v
add esi, 0x5ac
xor edi, edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
xor edi, edi
xor eax, eax
inc edi
cmp dword [esi + 0x5a8], eax
jne 0x409edd
mov esi, dword [ebp + 8]
push str.DoExit_v
add esi, 0x5ac
call fcn.0041a5c3
mov esi, dword [ebp + 8]
xor eax, eax
cmp dword [esi + 0x5a8], eax
jne 0x409efa
mov esi, dword [ebp + 8]
push str.DoExit_i
push 2
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x409f16
mov esi, dword [ebp + 8]
push str.DoSelectFolder_ss
push 3
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x409fd5
mov esi, dword [ebp + 8]
push str.SetInstallPath_s
push 4
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a03d
mov esi, dword [ebp + 8]
push str.GetInstallPath_v
push 5
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a08c
mov esi, dword [ebp + 8]
push str.RemoveEndBS_s
push 6
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a0a8
mov esi, dword [ebp + 8]
push str.SetName_s
push 7
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a0d5
mov esi, dword [ebp + 8]
push str.GetAppVersion_v
push 8
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a0fc
mov esi, dword [ebp + 8]
push str.GetBetaVersion_v
push 9
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a113
mov esi, dword [ebp + 8]
push str.GetTargetMachine_v
push 0xa
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a11b
mov esi, dword [ebp + 8]
push str.GetUninstDispName_v
push 0xb
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a123
mov esi, dword [ebp + 8]
push str.DigPath_s
push 0xc
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a151
mov esi, dword [ebp + 8]
push str.LoadRTF_is
push 0xd
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a1a3
mov esi, dword [ebp + 8]
push str.SetLanguage_s
push 0xe
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a1d3
mov esi, dword [ebp + 8]
push str.SetTitle_s
push 0xf
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a213
mov esi, dword [ebp + 8]
push str.GetLanguageAsLocal_v
push 0x10
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a22c
mov esi, dword [ebp + 8]
push str.GetLanguage_v
push 0x11
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a275
mov esi, dword [ebp + 8]
push str.Is64BitOS_v
push 0x12
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a28e
mov esi, dword [ebp + 8]
push str.IsKoreanOS_v
push 0x13
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a2b3
mov esi, dword [ebp + 8]
push str.GetPlatform_v
push 0x14
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a2fa
mov esi, dword [ebp + 8]
push str.LANG_s
push 0x15
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a340
mov esi, dword [ebp + 8]
push str.GetRegStr_s
push 0x16
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a3b6
mov esi, dword [ebp + 8]
push str.GetRegStr64_s
push 0x17
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a424
mov esi, dword [ebp + 8]
push str.GetRegInt_s
push 0x18
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a46c
mov esi, dword [ebp + 8]
push str.GetRegInt64_s
push 0x19
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a486
mov esi, dword [ebp + 8]
push str.SetRegStr_ss
push 0x1a
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a514
mov esi, dword [ebp + 8]
push str.SetRegStr64_ss
push 0x1b
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a589
mov esi, dword [ebp + 8]
push str.SetRegInt_si
push 0x1c
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a5cc
mov esi, dword [ebp + 8]
push str.SetRegInt64_si
push 0x1d
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a5e9
mov esi, dword [ebp + 8]
push str.MessageBox_s
push 0x1e
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a620
mov esi, dword [ebp + 8]
push str.MessageBox_i
push 0x1f
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a67a
mov esi, dword [ebp + 8]
push str.MessageBox_si
push 0x20
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a6cc
mov esi, dword [ebp + 8]
push str.CreateShortcut_ssss
push 0x21
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a786
mov esi, dword [ebp + 8]
push str.ExecWait_ss
push 0x22
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a786
mov esi, dword [ebp + 8]
push str.Sleep_i
push 0x23
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a7b2
mov esi, dword [ebp + 8]
push str.TouchURL_ss
push 0x24
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a7e6
mov esi, dword [ebp + 8]
push str.ShellExecute_s
push 0x25
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a83f
mov esi, dword [ebp + 8]
push str.ShellExecute_ss
push 0x26
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a8c4
mov esi, dword [ebp + 8]
push str.RunNonElevated_ss
push 0x27
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a965
mov esi, dword [ebp + 8]
push str.GetPackingDate_s
push 0x28
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a9a7
mov esi, dword [ebp + 8]
push str.GetIniStr_sss
push 0x29
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40a9fd
mov esi, dword [ebp + 8]
push str.CloseApp_ss
push 0x2a
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40aa37
mov esi, dword [ebp + 8]
push str.CloseApp_s
push 0x2b
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40aa4f
mov esi, dword [ebp + 8]
push str.WaitAppExit_si
push 0x2c
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40aa8a
mov esi, dword [ebp + 8]
push str.DeleteFile_s
push 0x2d
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ab85
mov esi, dword [ebp + 8]
push 0x470fec
push 0x2e
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40abac
mov esi, dword [ebp + 8]
push str.RemoveDirectory_s
push 0x2f
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40abdf
mov esi, dword [ebp + 8]
push str.DeleteFolderRec_s
push 0x30
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ac09
mov esi, dword [ebp + 8]
push str.RegDeleteKey_s
push 0x31
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ac2f
mov esi, dword [ebp + 8]
push str.RegDeleteKey64_s
push 0x32
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ac36
mov esi, dword [ebp + 8]
push str.GetAccountType_v
push 0x33
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ac40
mov esi, dword [ebp + 8]
push str.IsXPOrLess_v
push 0x34
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ac6a
mov esi, dword [ebp + 8]
push str.IsVistaOrLess_v
push 0x35
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ac79
mov esi, dword [ebp + 8]
push str.IsWin10OrLater_v
push 0x36
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ac88
mov esi, dword [ebp + 8]
push str.IsWin11OrLater_v
push 0x37
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ac94
mov esi, dword [ebp + 8]
push str.GetTime_v
push 0x38
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40aca4
mov esi, dword [ebp + 8]
push str.HideWindow_v
push 0x39
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40acb4
mov esi, dword [ebp + 8]
push str.GetCommandLine_v
push 0x3a
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40acf8
mov esi, dword [ebp + 8]
push str.GetCommandLine_i
push 0x3b
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ad3e
mov esi, dword [ebp + 8]
push str.GetParam_i
push 0x3c
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ad84
mov esi, dword [ebp + 8]
push str.IsCommandLineAuto_v
push 0x3d
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ad90
mov esi, dword [ebp + 8]
push str.IsCommandLineSilent_v
push 0x3e
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ad9c
mov esi, dword [ebp + 8]
push str.IsFile_s
push 0x3f
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40add2
mov esi, dword [ebp + 8]
push str.CheckVersionAsync_ssssss
push 0x40
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40ae92
mov esi, dword [ebp + 8]
push str.FindWindow_s
push 0x41
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40aeb9
mov esi, dword [ebp + 8]
push str.FindProcess_s
push 0x42
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40aedc
mov esi, dword [ebp + 8]
push str.CopyFile_ss
push 0x43
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40af42
mov esi, dword [ebp + 8]
push str.ShowMainWindow_i
push 0x44
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40af5a
mov esi, dword [ebp + 8]
push str.SetFocusByID_i
push 0x45
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40af87
mov esi, dword [ebp + 8]
push str.GetControlText_i
push 0x46
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40afcd
mov esi, dword [ebp + 8]
push str.SetControlEnable_ii
push 0x47
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40aff8
mov esi, dword [ebp + 8]
push str.IsValidEmail_s
push 0x48
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40b010
mov esi, dword [ebp + 8]
push str.IsValidBandizipEntProductKey_s
push 0x49
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40b028
mov esi, dword [ebp + 8]
push str.IsValidBandiviewProductKey_s
push 0x4a
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40b040
mov esi, dword [ebp + 8]
push str.IsShiftPressing_v
push 0x4b
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40b072
mov esi, dword [ebp + 8]
push str.MutexExist_s
push 0x4c
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40b0bc
mov esi, dword [ebp + 8]
push str.HasString_ss
push 0x4d
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40b112
mov esi, dword [ebp + 8]
push str.SetupFileNameHasString_s
push 0x4e
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40b181
mov esi, dword [ebp + 8]
push str.PinToTaskbar_s
push 0x4f
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40b1cf
mov esi, dword [ebp + 8]
push str.GetLocalAppDataPath_s
push 0x50
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40b22a
mov esi, dword [ebp + 8]
push str.GetProgramDataPath_s
push 0x51
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
cmp dword [esi + 0x5a8], 0
jne 0x40b27a
mov esi, dword [ebp + 8]
push str.WritePrivateProfileString_ssss
push 0x52
add esi, 0x5ac
pop edi
call fcn.0041a5c3
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [esi + 0x5a8], 1
cmp dword [esp + 0x38], edi
jne 0x409179
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
call fcn.004017c3
xor eax, eax
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi + 0x4f8]
cmp dword [eax - 0xc], edi
jne 0x409e68
push edi
push 0x46f164
push str.call_SetName___first
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x409e21
mov eax, dword [esi + 0x504]
cmp dword [eax - 0xc], edi
jne 0x409e99
push edi
push 0x46f164
push str.call_SetInstallPath___first
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor esi, esi
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
call fcn.004017c3
mov eax, esi
jmp 0x409e2f
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
call fcn.00402b61
pop ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 2
mov dword [ecx + 8], eax
test eax, eax
je 0x409ed8
push 0
push 0x800a
push 0x111
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
xor esi, esi
inc esi
jmp 0x409e89
mov dword [esi + 0x4bc], edi
mov dword [esi + 0x4b8], eax
push eax
push eax
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov esi, edi
jmp 0x409e89
xor edi, edi
inc edi
mov dword [esi + 0x4bc], edi
mov dword [esi + 0x4b8], eax
mov ecx, dword [ebx]
mov ecx, dword [ecx + 8]
mov dword [esi + 0x4d0], ecx
jmp 0x409ee9
push dword [ebx]
lea esi, [esp + 0x20]
call fcn.00440c0e
mov byte [esp + 0xc0], 1
push dword [ebx + 4]
lea esi, [esp + 0x18]
call fcn.00440c0e
mov byte [esp + 0xc0], 2
mov esi, dword [esp + 0x14]
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x24], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xc4], 3
mov ebx, dword [esp + 0x20]
push ecx
add ebx, 0xfffffff0
mov eax, ebx
mov dword [esp + 0x34], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
lea eax, [esp + 0x2c]
push eax
push dword [ebp + 8]
mov byte [esp + 0xd0], 2
call fcn.0040bd47
mov byte [esp + 0xc0], 4
mov eax, dword [esp + 0x24]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
call fcn.00440cf8
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
call fcn.004017c3
mov eax, esi
call fcn.004017c3
mov eax, ebx
call fcn.004017c3
jmp 0x409ed8
push dword [ebx]
lea esi, [esp + 0x9c]
call fcn.00440c0e
mov edi, dword [ebp + 8]
add edi, 0x504
mov byte [esp + 0xc0], 5
call fcn.00401470
mov byte [esp + 0xc0], 0
mov eax, dword [esp + 0x98]
add eax, 0xfffffff0
call fcn.004017c3
mov eax, dword [edi]
push ecx
sub eax, 0x10
mov dword [esp + 0x18], esp
mov esi, esp
call fcn.004015e7
add eax, 0x10
mov dword [esi], eax
call fcn.00402b61
pop ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 2
mov dword [ecx + 8], eax
jmp 0x409ed8
mov eax, dword [esi + 0x504]
sub eax, 0x10
call fcn.004015e7
add eax, 0x10
mov dword [esp + 0x24], eax
lea edi, [esp + 0x24]
mov byte [esp + 0xc0], 6
call fcn.0040312f
mov esi, dword [esp + 0x24]
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x18], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
call fcn.00440cf8
mov eax, esi
jmp 0x409fcb
push dword [ebx]
lea esi, [esp + 0x28]
call fcn.00440c0e
mov ecx, esi
mov byte [esp + 0xc0], 7
call fcn.004031d7
jmp 0x40a063
push dword [ebx]
lea esi, [esp + 0x7c]
call fcn.00440c0e
mov edi, dword [ebp + 8]
add edi, 0x4f8
mov byte [esp + 0xc0], 8
call fcn.00401470
mov eax, dword [esp + 0x78]
add eax, 0xfffffff0
jmp 0x409fcb
mov eax, dword [esi + 0x518]
push ecx
sub eax, 0x10
mov dword [esp + 0x18], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
call fcn.00440cf8
jmp 0x409ed8
mov esi, dword [esi + 0x51c]
mov eax, dword [ebp + 0x10]
mov dword [eax], 2
mov dword [eax + 8], esi
jmp 0x409ed8
mov eax, dword [esi + 0x524]
jmp 0x40a0db
mov eax, dword [esi + 0x528]
jmp 0x40a0db
push dword [ebx]
lea esi, [esp + 0x28]
call fcn.00440c0e
push ecx
mov byte [esp + 0xc4], 9
mov edi, esp
mov dword [esp + 0x18], esp
call fcn.00403405
call fcn.004027c6
mov eax, dword [esp + 0x28]
pop ecx
jmp 0x40a0cd
mov eax, dword [ebx]
mov eax, dword [eax + 8]
push dword [ebx + 4]
lea esi, [esp + 0x28]
mov dword [esp + 0x18], eax
call fcn.00440c0e
push ecx
mov byte [esp + 0xc4], 0xa
mov edi, esp
mov dword [esp + 0x20], esp
call fcn.00403405
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.0040b450
mov esi, dword [esp + 0x24]
test eax, eax
jne 0x40a19b
push esi
push str.LoadRTF__s__FALSE
call fcn.0040252c
pop ecx
pop ecx
lea eax, [esi - 0x10]
jmp 0x409fcb
push ecx
mov esi, esp
mov dword [esp + 0x18], esp
push dword [ebx]
call fcn.00440c0e
mov edi, dword [ebp + 8]
lea esi, [edi + 0x608]
call fcn.0040df45
push 0
push 0x801a
push 0x111
push dword [edi + 4]
jmp 0x409ed2
push dword [ebx]
lea esi, [esp + 0x5c]
call fcn.00440c0e
mov edi, dword [ebp + 8]
add edi, 0x500
mov byte [esp + 0xc0], 0xb
call fcn.00401470
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
call fcn.004017c3
push dword [edi]
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x409ed8
mov eax, dword [ebp + 8]
push ecx
add eax, 0x608
mov esi, esp
mov dword [esp + 0x18], esp
call fcn.0040e052
jmp 0x40a0ef
lea ecx, [esi + 0x608]
lea edx, [esp + 0x44]
call fcn.0040e018
lea eax, [esp + 0x44]
mov byte [esp + 0xc0], 0xc
call fcn.00405058
mov eax, dword [esp + 0x44]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
call fcn.004015e7
mov edi, dword [ebp + 0x10]
add eax, 0x10
mov dword [esi], eax
call fcn.00440cf8
mov eax, dword [esp + 0x44]
jmp 0x40a0cd
call fcn.00402fe6
cmp byte [esi + 0x530], 0
je 0x40a02c
xor eax, eax
jmp 0x40a02c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov ecx, dword [ebp + 0x10]
xor edx, edx
and eax, 0x3ff
cmp ax, 0x12
sete dl
mov dword [ecx], 2
mov dword [ecx + 8], edx
jmp 0x409ed8
cmp byte [esi + 0x530], 0
je 0x40a2ca
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push 0x46ee48
jmp 0x40a2df
cmp byte [esi + 0x531], 0
je 0x40a2ea
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.ARM64
push eax
call fcn.004021f9
jmp 0x40a0ef
call fcn.00403039
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push eax
push ecx
jmp 0x40a2e0
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.00440c0e
mov byte [esp + 0xc0], 0xd
mov esi, dword [esp + 0x14]
push esi
push ecx
call fcn.00436f5f
pop ecx
mov ecx, str.INSTALLER
mov edx, eax
call fcn.0043768e
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push eax
push ecx
call fcn.004021f9
mov edi, dword [ebp + 0x10]
call fcn.00440cf8
jmp 0x40a19b
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.00440c0e
mov byte [esp + 0xc0], 0xe
mov esi, dword [esp + 0x14]
push ecx
add esi, 0xfffffff0
mov eax, esi
xor ebx, ebx
mov dword [esp + 0x20], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
lea eax, [esp + 0x38]
push eax
mov ecx, ebx
call fcn.0041145a
mov byte [esp + 0xc8], 0xf
mov eax, dword [esp + 0x3c]
add esp, 4
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
call fcn.00440cf8
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
call fcn.004017c3
jmp 0x40a085
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x10
mov esi, dword [esp + 0x14]
push ecx
add esi, 0xfffffff0
mov eax, esi
mov ebx, 0x100
mov dword [esp + 0x20], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
lea eax, [esp + 0x2c]
push eax
mov ecx, ebx
call fcn.0041145a
mov byte [esp + 0xc8], 0x11
mov eax, dword [esp + 0x30]
add esp, 4
add eax, 0xfffffff0
mov dword [esp + 0x20], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
call fcn.00440cf8
mov eax, dword [esp + 0x28]
jmp 0x40a3a9
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x12
xor ebx, ebx
mov esi, dword [esp + 0x14]
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x20], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov ecx, ebx
mov dword [edi], eax
call fcn.0041155f
pop ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 2
mov dword [ecx + 8], eax
jmp 0x40a085
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x13
mov ebx, 0x100
jmp 0x40a439
push dword [ebx]
lea esi, [esp + 0x20]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x14
push dword [ebx + 4]
lea esi, [esp + 0x18]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x15
mov esi, dword [esp + 0x14]
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x24], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xc4], 0x16
mov edi, dword [esp + 0x20]
push ecx
add edi, 0xfffffff0
mov eax, edi
mov dword [esp + 0x34], esp
mov ebx, esp
call fcn.004015e7
add eax, 0x10
mov dword [ebx], eax
mov byte [esp + 0xc8], 0x15
xor ecx, ecx
call fcn.0041164b
pop ecx
pop ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 2
mov dword [ecx + 8], eax
mov eax, esi
call fcn.004017c3
mov eax, edi
jmp 0x409fcb
push dword [ebx]
lea esi, [esp + 0x20]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x17
push dword [ebx + 4]
lea esi, [esp + 0x18]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x18
mov esi, dword [esp + 0x14]
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x24], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xc4], 0x19
mov edi, dword [esp + 0x20]
push ecx
add edi, 0xfffffff0
mov eax, edi
mov dword [esp + 0x34], esp
mov ebx, esp
call fcn.004015e7
add eax, 0x10
mov dword [ebx], eax
mov byte [esp + 0xc8], 0x18
mov ecx, 0x100
jmp 0x40a4f3
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x1a
mov eax, dword [ebx + 4]
xor ebx, ebx
mov eax, dword [eax + 8]
mov esi, dword [esp + 0x14]
push eax
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x24], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov ecx, ebx
mov dword [edi], eax
call fcn.00411763
pop ecx
jmp 0x40a45a
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x1b
mov eax, dword [ebx + 4]
mov ebx, 0x100
jmp 0x40a5a1
cmp dword [esi + 0x4c4], 0
je 0x409ed8
push dword [ebx]
lea esi, [esp + 0x50]
call fcn.00440c0e
mov ecx, dword [ebp + 8]
push 0
push dword [ecx + 0x500]
push dword [eax]
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [esp + 0x4c]
jmp 0x40a0cd
mov eax, dword [0x4882ec]
mov ecx, 0x4882ec
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x28], eax
mov byte [esp + 0xc0], 0x1c
mov eax, dword [ebx]
push dword [eax + 8]
lea eax, [esp + 0x2c]
push 0x4716fc
push eax
call fcn.004024cb
mov edi, dword [esp + 0x34]
add esp, 0xc
cmp dword [esi + 0x4c4], 0
je 0x40a672
push 0
push dword [esi + 0x500]
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [edi - 0x10]
jmp 0x409fcb
xor edi, edi
inc edi
cmp dword [esi + 0x4c4], 0
je 0x40a6bb
push dword [ebx]
lea esi, [esp + 0x64]
call fcn.00440c0e
mov ecx, dword [ebp + 8]
mov esi, dword [ebx + 4]
push dword [esi + 8]
mov edx, dword [ecx + 0x500]
mov eax, dword [eax]
push edx
push eax
push dword [ecx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, eax
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
call fcn.004017c3
mov eax, dword [ebp + 0x10]
mov dword [eax], 2
mov dword [eax + 8], edi
jmp 0x409ed8
push dword [ebx + 0xc]
lea esi, [esp + 0x74]
call fcn.00440c0e
mov edi, eax
mov byte [esp + 0xc0], 0x1d
push dword [ebx + 8]
lea esi, [esp + 0x94]
call fcn.00440c0e
mov dword [esp + 0x14], eax
mov byte [esp + 0xc0], 0x1e
push dword [ebx + 4]
lea esi, [esp + 0x6c]
call fcn.00440c0e
mov dword [esp + 0x1c], eax
mov byte [esp + 0xc0], 0x1f
push dword [ebx]
lea esi, [esp + 0x84]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x20
mov edi, dword [edi]
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx]
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
mov eax, dword [eax]
push edi
push ecx
push edx
push eax
call fcn.00403609
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x90]
add esp, 0x10
add eax, 0xfffffff0
mov dword [ecx], 2
call fcn.004017c3
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
call fcn.004017c3
mov eax, dword [esp + 0x90]
add eax, 0xfffffff0
call fcn.004017c3
mov eax, dword [esp + 0x70]
jmp 0x40a0cd
push dword [esi + 4]
push dword [ebp + 0x10]
mov eax, dword [esp + 0x38]
push ebx
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov esi, esp
call fcn.004015e7
add eax, 0x10
mov dword [esi], eax
call fcn.00401377
add esp, 0x10
jmp 0x409ed8
push dword [ebx + 4]
lea esi, [esp + 0x8c]
call fcn.00440c0e
push dword [eax]
push str.TouchURL:__s
call fcn.0040252c
mov eax, dword [esp + 0x90]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.004017c3
mov eax, dword [ebp + 8]
push dword [eax + 4]
jmp 0x40a789
push dword [ebx]
lea esi, [esp + 0x54]
call fcn.00440c0e
mov eax, dword [eax]
push 5
xor ecx, ecx
push ecx
push ecx
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, eax
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
call fcn.004017c3
cmp esi, 0x20
jle 0x409ed8
push dword [ebx]
lea esi, [esp + 0x58]
call fcn.00440c0e
push dword [eax]
push str.__rShellExecute__s_failed
call fcn.0040252c
mov eax, dword [esp + 0x5c]
pop ecx
pop ecx
jmp 0x40a0cd
push dword [ebx + 4]
lea esi, [esp + 0x68]
call fcn.00440c0e
mov edi, eax
mov byte [esp + 0xc0], 0x21
push dword [ebx]
lea esi, [esp + 0x60]
call fcn.00440c0e
mov edi, dword [edi]
mov eax, dword [eax]
push 5
push 0
push edi
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, eax
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
call fcn.004017c3
mov byte [esp + 0xc0], 0
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
call fcn.004017c3
cmp esi, 0x20
jle 0x409ed8
push dword [ebx]
lea esi, [esp + 0x70]
call fcn.00440c0e
push dword [eax]
push str.__rShellExecute__s_failed
call fcn.0040252c
mov eax, dword [esp + 0x74]
pop ecx
pop ecx
jmp 0x40a0cd
push dword [ebx]
lea esi, [esp + 0x38]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x22
push dword [ebx + 4]
lea esi, [esp + 0x2c]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x23
mov esi, dword [esp + 0x28]
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x18], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
mov byte [esp + 0xc4], 0x24
mov edi, dword [esp + 0x38]
push ecx
add edi, 0xfffffff0
mov eax, edi
mov dword [esp + 0x24], esp
mov ebx, esp
call fcn.004015e7
push dword [ebp + 8]
add eax, 0x10
mov dword [ebx], eax
mov byte [esp + 0xcc], 0x23
call fcn.0040b9a1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 2
mov dword [ecx + 8], eax
test eax, eax
jne 0x40a506
push dword [esp + 0x28]
push dword [esp + 0x38]
push str.__rRunNonElevated__s___s_failed
call fcn.0040252c
add esp, 0xc
jmp 0x40a506
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x25
mov esi, dword [esp + 0x14]
push ecx
mov dword [esp + 0x20], esp
mov ebx, esp
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x24], esp
mov edi, esp
call fcn.004015e7
mov ecx, dword [ebp + 8]
add eax, 0x10
push ebx
mov dword [edi], eax
call fcn.0040b5ee
jmp 0x40a07d
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push ecx
mov esi, esp
mov dword [esp + 0x1c], esp
push dword [ebx + 8]
call fcn.00440c0e
push ecx
mov byte [esp + 0xcc], 0x26
mov esi, esp
mov dword [esp + 0x28], esp
push dword [ebx + 4]
call fcn.00440c0e
push ecx
mov byte [esp + 0xd0], 0x27
mov esi, esp
mov dword [esp + 0x30], esp
push dword [ebx]
call fcn.00440c0e
push edi
mov byte [esp + 0xd4], 0
call fcn.0040b68a
jmp 0x40a0ef
push ecx
mov esi, esp
mov dword [esp + 0x18], esp
push dword [ebx + 4]
call fcn.00440c0e
push ecx
mov byte [esp + 0xc8], 0x28
mov esi, esp
mov dword [esp + 0x24], esp
push dword [ebx]
call fcn.00440c0e
push dword [ebp + 8]
mov byte [esp + 0xcc], 0
call fcn.0040b738
jmp 0x40a02c
push ecx
mov esi, esp
mov dword [esp + 0x18], esp
push dword [ebx]
call fcn.00440c0e
call fcn.0040b7c2
jmp 0x40a02c
push dword [ebx]
lea esi, [esp + 0x3c]
call fcn.00440c0e
mov eax, dword [ebx + 4]
mov esi, dword [eax + 8]
jmp 0x40aa7d
push 0
push dword [esp + 0x3c]
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x40aa81
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esi, 0x64
test esi, esi
jg 0x40aa62
mov eax, dword [esp + 0x38]
jmp 0x40a0cd
push ecx
mov esi, esp
mov dword [esp + 0x18], esp
push dword [ebx]
call fcn.00440c0e
lea esi, [esp + 0x44]
call fcn.00403428
mov byte [esp + 0xc4], 0x29
xor ecx, ecx
mov dword [esp], 0x470fe4
call fcn.0040500e
test eax, eax
jge 0x40aae6
push 0x470fe8
xor ecx, ecx
call fcn.0040500e
test eax, eax
jge 0x40aae6
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 2
mov dword [ecx + 8], eax
jmp 0x40ab7c
xor eax, eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], 0xa
push eax
mov byte [esp + 0xc4], 0x2a
mov eax, dword [esp + 0x44]
push ecx
add eax, 0xfffffff0
lea ebx, [esp + 0xa4]
mov dword [esp + 0x1c], esp
mov esi, esp
call fcn.004015e7
add eax, 0x10
mov dword [esi], eax
call fcn.00404210
mov esi, dword [esp + 0xa4]
pop ecx
xor edi, edi
pop ecx
inc edi
jmp 0x40ab60
mov eax, esi
push dword [eax + 8]
mov esi, dword [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and edi, eax
test esi, esi
jne 0x40ab51
mov eax, dword [ebp + 0x10]
lea ecx, [esp + 0x9c]
mov dword [eax], 2
mov dword [eax + 8], edi
call fcn.00405285
mov eax, dword [esp + 0x40]
jmp 0x40a0cd
push ecx
mov dword [esp + 0x18], esp
mov edi, esp
push ecx
mov esi, esp
mov dword [esp + 0x1c], esp
push dword [ebx]
call fcn.00440c0e
mov esi, edi
call fcn.00403428
pop ecx
call fcn.0040b824
jmp 0x40a02c
push ecx
mov esi, esp
mov dword [esp + 0x18], esp
push dword [ebx]
call fcn.00440c0e
lea esi, [esp + 0x78]
call fcn.00403428
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
mov eax, dword [esp + 0x74]
add eax, 0xfffffff0
call fcn.004017c3
jmp 0x40a102
push 1
push ecx
mov dword [esp + 0x1c], esp
mov edi, esp
push ecx
mov esi, esp
mov dword [esp + 0x20], esp
push dword [ebx]
call fcn.00440c0e
mov esi, edi
call fcn.00403428
pop ecx
call fcn.00403c05
pop ecx
jmp 0x40a02b
push 0
push ecx
mov dword [esp + 0x1c], esp
mov edi, esp
push ecx
mov esi, esp
mov dword [esp + 0x20], esp
push dword [ebx]
call fcn.00440c0e
mov esi, edi
call fcn.00403428
pop ecx
call fcn.00403dc8
jmp 0x40ac03
push 0x100
jmp 0x40ac0b
call fcn.0040eefc
jmp 0x40a2ef
call fcn.00404005
xor ecx, ecx
cmp eax, 7
setl cl
cmp byte [esi + 0x534], 0
je 0x40ac59
xor ecx, ecx
inc ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], 2
mov dword [eax + 8], ecx
jmp 0x409ed8
call fcn.00404005
xor ecx, ecx
cmp eax, 0xa
setl cl
jmp 0x40ac59
call fcn.00404005
xor ecx, ecx
cmp eax, 0x11
setge cl
jmp 0x40ac59
call fcn.00404005
xor ecx, ecx
cmp eax, 0x12
jmp 0x40ac83
push 0
call fcn.0044a54d
mov dword [esp + 0x1c], edx
jmp 0x40a02b
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x409ed8
mov edi, dword [ebp + 8]
add edi, 0x530
lea esi, [esp + 0x7c]
mov eax, edi
call fcn.00407786
push dword [eax]
push str.GetCommandLine____s
call fcn.0040252c
mov eax, dword [esp + 0x84]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.004017c3
push ecx
mov esi, esp
mov eax, edi
mov dword [esp + 0x18], esp
call fcn.00407786
jmp 0x40a0ef
mov eax, dword [ebx]
mov ebx, dword [eax + 8]
lea eax, [esp + 0x48]
push eax
lea ecx, [esi + 0x530]
call fcn.00401b5c
mov byte [esp + 0xc0], 0x2b
mov eax, dword [esp + 0x48]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
call fcn.004015e7
mov edi, dword [ebp + 0x10]
add eax, 0x10
mov dword [esi], eax
call fcn.00440cf8
mov eax, dword [esp + 0x48]
jmp 0x40a0cd
mov eax, dword [ebx]
mov ebx, dword [eax + 8]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esi + 0x530]
call fcn.00401bb8
mov byte [esp + 0xc0], 0x2c
mov eax, dword [esp + 0x2c]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
call fcn.004015e7
mov edi, dword [ebp + 0x10]
add eax, 0x10
mov dword [esi], eax
call fcn.00440cf8
mov eax, dword [esp + 0x2c]
jmp 0x40a0cd
movzx eax, byte [esi + 0x533]
jmp 0x40a02c
movzx eax, byte [esi + 0x532]
jmp 0x40a02c
push dword [ebx]
lea esi, [esp + 0x88]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x2d
push dword [eax]
call fcn.0041bec0
pop ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x84]
mov dword [ecx], 2
jmp 0x40a0cd
push dword [ebx + 0xc]
lea esi, [esp + 0x18]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x2e
mov edi, dword [esp + 0x14]
push edi
push str.CheckVersionAsync__s__
call fcn.0040252c
pop ecx
mov esi, esp
mov dword [esp + 0x20], esp
push dword [ebx + 0x14]
call fcn.00440c0e
push ecx
mov byte [esp + 0xc8], 0x2f
mov esi, esp
mov dword [esp + 0x28], esp
push dword [ebx + 0x10]
call fcn.00440c0e
push ecx
add edi, 0xfffffff0
mov byte [esp + 0xcc], 0x30
mov eax, edi
mov dword [esp + 0x38], esp
mov esi, esp
call fcn.004015e7
add eax, 0x10
mov dword [esi], eax
push ecx
mov byte [esp + 0xd0], 0x31
mov esi, esp
mov dword [esp + 0x58], esp
push dword [ebx + 8]
call fcn.00440c0e
push ecx
mov byte [esp + 0xd4], 0x32
mov esi, esp
mov dword [esp + 0x3c], esp
push dword [ebx + 4]
call fcn.00440c0e
push ecx
mov byte [esp + 0xd8], 0x33
mov esi, esp
mov dword [esp + 0x4c], esp
push dword [ebx]
call fcn.00440c0e
mov ecx, dword [ebp + 8]
mov byte [esp + 0xd8], 0x2e
call fcn.0040ba72
jmp 0x40a50d
push dword [ebx]
lea esi, [esp + 0x90]
call fcn.00440c0e
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
mov eax, dword [esp + 0x8c]
jmp 0x40abd2
push dword [ebx]
lea esi, [esp + 0x98]
call fcn.00440c0e
mov edi, dword [eax]
call fcn.00404a03
mov esi, eax
mov eax, dword [esp + 0x94]
jmp 0x40abd2
push dword [ebx]
lea esi, [esp + 0x20]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x34
push dword [ebx + 4]
lea esi, [esp + 0x18]
call fcn.00440c0e
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
push esi
push edi
test ebx, ebx
jne 0x40af1c
push str.__rCopyFile__s___s_failed
jmp 0x40af21
push str.CopyFile__s___s__success
call fcn.0040252c
mov eax, dword [ebp + 0x10]
mov dword [eax], 2
mov dword [eax + 8], ebx
add esp, 0xc
lea eax, [esi - 0x10]
call fcn.004017c3
jmp 0x40a672
mov eax, dword [ebx]
mov eax, dword [eax + 8]
mov dword [esi + 0x4c4], eax
neg eax
sbb eax, eax
and eax, 5
push eax
jmp 0x40aca6
mov eax, dword [ebp + 8]
mov ecx, dword [ebx]
mov esi, dword [ecx + 8]
add eax, 0x28
push eax
mov dword [esp + 0x18], eax
call fcn.0042294c
test eax, eax
je 0x409ed8
mov edi, eax
mov eax, dword [esp + 0x14]
call fcn.00422eeb
jmp 0x409ed8
mov ecx, dword [ebp + 8]
mov eax, dword [ebx]
mov esi, dword [eax + 8]
add ecx, 0x28
push ecx
lea edi, [esp + 0x24]
call fcn.00422e4d
mov byte [esp + 0xc0], 0x35
mov eax, dword [esp + 0x20]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x18], esp
mov esi, esp
call fcn.004015e7
mov edi, dword [ebp + 0x10]
add eax, 0x10
mov dword [esi], eax
call fcn.00440cf8
mov eax, dword [esp + 0x20]
jmp 0x40a0cd
mov ecx, dword [ebp + 8]
mov eax, dword [ebx]
mov esi, dword [eax + 8]
add ecx, 0x28
push ecx
call fcn.0042294c
test eax, eax
je 0x409ed8
mov ecx, dword [ebx + 4]
push dword [ecx + 8]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x78]
jmp 0x409ed8
push ecx
mov esi, esp
mov dword [esp + 0x18], esp
push dword [ebx]
call fcn.00440c0e
call fcn.00404506
jmp 0x40a02b
push ecx
mov esi, esp
mov dword [esp + 0x18], esp
push dword [ebx]
call fcn.00440c0e
call fcn.0040454c
jmp 0x40a02b
push ecx
mov esi, esp
mov dword [esp + 0x18], esp
push dword [ebx]
call fcn.00440c0e
call fcn.004045b2
jmp 0x40a02b
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa0
call esi
cwde
mov edi, 0x10000
test edi, eax
jne 0x40ac56
push 0xa1
call esi
cwde
test edi, eax
jne 0x40ac56
xor ecx, ecx
jmp 0x40ac59
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.00440c0e
mov edi, dword [esp + 0x14]
push edi
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
cmp ebx, esi
je 0x40b0a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40b0a0
inc esi
test ebx, ebx
je 0x40b0ab
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0x10]
mov dword [eax], 2
mov dword [eax + 8], esi
jmp 0x40a672
push dword [ebx]
lea esi, [esp + 0x24]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x36
push dword [ebx + 4]
lea esi, [esp + 0x18]
call fcn.00440c0e
mov edi, dword [esp + 0x14]
push edi
xor ecx, ecx
lea esi, [esp + 0x24]
call fcn.0040500e
test eax, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], 2
jl 0x40b101
mov dword [eax + 8], 1
jmp 0x40b105
and dword [eax + 8], 0
lea eax, [edi - 0x10]
call fcn.004017c3
jmp 0x40afc4
lea esi, [esp + 0x3c]
call fcn.00402cd6
mov byte [esp + 0xc0], 0x37
push dword [ebx]
lea esi, [esp + 0x24]
call fcn.00440c0e
lea eax, [esp + 0x3c]
mov byte [esp + 0xc0], 0x38
call fcn.00405058
mov eax, esi
call fcn.00405058
mov edi, dword [esp + 0x20]
push edi
xor ecx, ecx
lea esi, [esp + 0x40]
call fcn.0040500e
test eax, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], 2
jl 0x40b16c
mov dword [eax + 8], 1
jmp 0x40b170
and dword [eax + 8], 0
lea eax, [edi - 0x10]
call fcn.004017c3
mov eax, dword [esp + 0x3c]
jmp 0x40a0cd
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x39
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.SHELL32.dll_ILCreateFromPathW]
mov esi, eax
test esi, esi
je 0x40b1bd
push esi
call fcn.00441e57
pop ecx
push esi
mov bl, al
call dword [sym.imp.SHELL32.dll_ILFree]
test bl, bl
jne 0x40a672
push edi
push str.PinCurrentAppToTaskbarImpl__s_
call fcn.0040252c
pop ecx
pop ecx
jmp 0x40a672
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x3a
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
mov eax, esi
call fcn.00404d7c
mov byte [esp + 0xc4], 0x3b
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
call fcn.00440cf8
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.004017c3
jmp 0x40a19b
push dword [ebx]
lea esi, [esp + 0x20]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x3c
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
mov eax, esi
call fcn.00404da6
mov byte [esp + 0xc4], 0x3d
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x24], esp
mov edi, esp
call fcn.004015e7
add eax, 0x10
mov dword [edi], eax
mov edi, dword [ebp + 0x10]
call fcn.00440cf8
mov eax, dword [esp + 0x14]
jmp 0x40b21d
push dword [ebx]
lea esi, [esp + 0x18]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x3e
push dword [ebx + 4]
lea esi, [esp + 0x30]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x3f
push dword [ebx + 8]
lea esi, [esp + 0x24]
call fcn.00440c0e
mov byte [esp + 0xc0], 0x40
push dword [ebx + 0xc]
lea esi, [esp + 0x20]
call fcn.00440c0e
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
push esi
push edi
push ebx
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [esi - 0x10]
call fcn.004017c3
lea eax, [edi - 0x10]
call fcn.004017c3
lea eax, [ebx - 0x10]
call fcn.004017c3
mov eax, dword [esp + 0x14]
jmp 0x40a0cd