Function at 0x401796
Capabilities:
Check mutex on windows
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3a4
mov eax, dword [0x45a06c]
xor eax, esp
mov dword [esp + 0x3a0], eax
push ebx
push esi
push edi
xor edi, edi
push 0x450878
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push str.SetSearchPathMode
mov ebx, str.kernel32.dll
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetDefaultDllDirectories
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x40180e
test esi, esi
je 0x40180e
push 0x8001
call esi
push 0x800
call ebx
push 2
pop esi
jmp 0x40181d
lea ecx, [esp + 0x14]
call fcn.0041e7fc
mov edi, dword [esp + 0x14]
mov esi, eax
push str.lite_installer.log
lea ecx, [esp + 0x1a4]
call fcn.0040c463
mov ecx, eax
call fcn.0040239a
xor ecx, ecx
mov edx, eax
inc ecx
mov ebx, 0x45bc00
xor eax, eax
lock cmpxchg dword [ebx], ecx
test eax, eax
jne 0x401854
push edx
mov ecx, 0x45bc04
call fcn.0040675a
lea ecx, [esp + 0x1a0]
call fcn.00402499
xor ebx, ebx
mov dword [esp + 0x1b4], 7
xor eax, eax
mov dword [esp + 0x1b0], ebx
push str._______________________________________Start_install.
lea ecx, [esp + 0x1a4]
mov word [esp + 0x1a4], ax
mov byte [esp + 0x1bc], bl
call fcn.004011b7
lea eax, [esp + 0x1a0]
push eax
push eax
push 0x80
push str.wWinMain
push ebx
call fcn.00415994
add esp, 0x14
lea ecx, [esp + 0x1a0]
call fcn.00402499
sub esi, ebx
je 0x4022e9
sub esi, 1
je 0x401a11
sub esi, 1
je 0x4019b1
sub esi, 1
je 0x40194b
sub esi, 1
je 0x402345
push 7
pop esi
push 0xc
push str.run_as_admin
lea ecx, [esp + 0x1a8]
mov dword [esp + 0x1b8], ebx
mov dword [esp + 0x1bc], 0xf
mov byte [esp + 0x1a8], bl
call fcn.0040256f
lea eax, [esp + 0x1a0]
push eax
push ecx
call fcn.0041f106
pop ecx
mov ecx, eax
call fcn.0041f267
lea ecx, [esp + 0x1a0]
mov bl, al
call fcn.00402525
test bl, bl
je 0x401a54
call fcn.00401393
jmp 0x402347
xor eax, eax
mov dword [esp + 0x1b0], ebx
push str.Exiting__DLL_files_found_in_working_directory
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x1b8], 7
mov word [esp + 0x1a4], ax
mov byte [esp + 0x1bc], bl
call fcn.004011b7
lea eax, [esp + 0x1a0]
push eax
push eax
push 0x8f
push str.wWinMain
push ebx
call fcn.00415994
add esp, 0x14
lea ecx, [esp + 0x1a0]
call fcn.00402499
mov eax, 0xffffff38
jmp 0x402347
push 7
pop esi
xor eax, eax
mov dword [esp + 0x1b0], ebx
push str.Runned_in_secure_environment.
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x1b8], esi
mov word [esp + 0x1a4], ax
mov byte [esp + 0x1bc], bl
call fcn.004011b7
lea eax, [esp + 0x1a0]
push eax
push eax
push 0x8c
push str.wWinMain
push ebx
call fcn.00415994
add esp, 0x14
lea ecx, [esp + 0x1a0]
call fcn.00402499
jmp 0x4018e9
push 7
pop esi
xor eax, eax
mov dword [esp + 0x1b0], ebx
push str.Cant_find_secure_environment.
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x1b8], esi
mov word [esp + 0x1a4], ax
mov byte [esp + 0x1bc], bl
call fcn.004011b7
lea eax, [esp + 0x1a0]
push eax
push eax
push 0x87
jmp 0x4019f2
lea ecx, [esp + 0x1c]
call fcn.0040ea88
xor ebx, ebx
mov dword [esp + 0x1b4], esi
xor eax, eax
mov dword [esp + 0x1b0], ebx
push str.Lite_installer_mode.
lea ecx, [esp + 0x1a4]
mov word [esp + 0x1a4], ax
mov byte [esp + 0x1bc], bl
call fcn.004011b7
lea eax, [esp + 0x1a0]
push eax
push eax
push 0x9e
push str.wWinMain
push ebx
call fcn.00415994
add esp, 0x14
lea ecx, [esp + 0x1a0]
call fcn.00402499
push str.LocalYandexBrowserLiteInstallerMutex_E523E369_4A72_4B13_AD57_5B956174172A
push ebx
push ebx
mov byte [esp + 0x1e], bl
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
mov dword [esp + 0x18], edi
test edi, edi
je 0x4021d8
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
sete byte [esp + 0x12]
test eax, eax
jne 0x4021d8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
mov dword [esp + 0x1b0], ebx
xor eax, eax
mov dword [section.SHARED], esi
push str.Installer_process_id:
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x1b8], 7
mov word [esp + 0x1a4], ax
mov byte [esp + 0x1bc], bl
call fcn.004011b7
push esi
mov ecx, eax
call fcn.004012b3
lea eax, [esp + 0x1a0]
push eax
push eax
push 0xaa
push str.wWinMain
push ebx
call fcn.00415994
add esp, 0x14
lea ecx, [esp + 0x1a0]
call fcn.00402499
push 0xf
pop esi
push 6
push str.silent
lea ecx, [esp + 0x1a8]
mov dword [esp + 0x1b8], ebx
mov dword [esp + 0x1bc], esi
mov byte [esp + 0x1a8], bl
call fcn.0040256f
lea eax, [esp + 0x1a0]
push eax
push ecx
call fcn.0041f106
pop ecx
mov ecx, eax
call fcn.0041f267
lea ecx, [esp + 0x1a0]
mov bh, al
call fcn.00402525
and dword [esp + 0x1b0], 0
lea ecx, [esp + 0x1a0]
push 0xc
push str.system_level
mov dword [esp + 0x1bc], esi
mov byte [esp + 0x1a8], 0
call fcn.0040256f
lea eax, [esp + 0x1a0]
push eax
push ecx
call fcn.0041f106
pop ecx
mov ecx, eax
call fcn.0041f267
lea ecx, [esp + 0x1a0]
mov byte [esp + 0x13], al
call fcn.00402525
and dword [esp + 0x1b0], 0
lea ecx, [esp + 0x1a0]
push 0xa
push 0x453d38
mov dword [esp + 0x1bc], esi
mov byte [esp + 0x1a8], 0
call fcn.0040256f
lea eax, [esp + 0x1a0]
push eax
lea eax, [esp + 0x214]
push eax
call fcn.0041f106
mov ecx, eax
call fcn.0041f2cd
lea ecx, [esp + 0x1a0]
call fcn.00402525
lea ecx, [esp + 0x1e0]
call fcn.0040c463
and dword [esp + 0x1b0], 0
push 7
pop esi
xor eax, eax
mov dword [esp + 0x1b4], esi
push str.Temporary_path_is:
lea ecx, [esp + 0x1a4]
mov word [esp + 0x1a4], ax
mov byte [esp + 0x1bc], al
call fcn.004011b7
cmp dword [esp + 0x1f4], 8
lea ecx, [esp + 0x1e0]
push dword [esp + 0x1f0]
cmovae ecx, dword [esp + 0x1e4]
push ecx
mov ecx, eax
call fcn.004024c4
lea eax, [esp + 0x1a0]
push eax
push eax
push 0xb5
push str.wWinMain
push 0
call fcn.00415994
add esp, 0x14
lea ecx, [esp + 0x1a0]
call fcn.00402499
and dword [esp + 0x1d0], 0
lea ecx, [esp + 0x1d8]
xor eax, eax
mov dword [esp + 0x1bc], 0x45714c
mov dword [esp + 0x1d4], esi
mov word [esp + 0x1c0], ax
call fcn.0040332d
lea ecx, [esp + 0x1bc]
call fcn.00406522
lea eax, [esp + 0x1e0]
push eax
lea ecx, [esp + 0x94]
call fcn.00404ac0
lea eax, [esp + 0x210]
push eax
lea ecx, [esp + 0x94]
call fcn.00404d87
push 0xf
pop ecx
xor eax, eax
mov dword [esp + 0x20c], ecx
push 4
mov dword [esp + 0x1b8], ecx
lea ecx, [esp + 0x1a4]
push 0x451b4c
mov dword [esp + 0x210], eax
mov byte [esp + 0x200], al
mov dword [esp + 0x1b8], eax
mov byte [esp + 0x1a8], al
call fcn.0040256f
lea eax, [esp + 0x1f8]
push eax
lea eax, [esp + 0x1a4]
push eax
lea ecx, [esp + 0x1c4]
call fcn.00406683
lea ecx, [esp + 0x1a0]
mov bl, al
call fcn.00402525
test bl, bl
je 0x401dc7
lea eax, [esp + 0x1f8]
push eax
lea ecx, [esp + 0xe0]
call fcn.0040241c
lea ecx, [esp + 0x90]
call fcn.00405545
call fcn.0041a200
push 0xa
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jne 0x401e5a
and dword [esp + 0x1b0], eax
lea ecx, [esp + 0x1a0]
push str.CPU_is_not_supported
mov dword [esp + 0x1b8], esi
mov word [esp + 0x1a4], ax
mov byte [esp + 0x1bc], al
call fcn.004011b7
lea eax, [esp + 0x1a0]
push eax
push eax
push 0xcf
push str.wWinMain
push 1
call fcn.00415994
add esp, 0x14
lea ecx, [esp + 0x1a0]
call fcn.00402499
test bh, bh
jne 0x401e50
mov ecx, dword [esp + 0xf4]
mov edx, 0x1b1
call fcn.0040d9b3
mov ebx, 0x194
jmp 0x40216d
mov cl, byte [esp + 0x13]
call fcn.0040d520
test bh, bh
jne 0x401f83
test al, al
jne 0x401ed6
push dword [esp + 0xf4]
mov ebx, 0x193
mov dword [esp + 0x1a4], 0x19b
lea ecx, [esp + 0x3c]
mov dword [esp + 0x1a8], ebx
mov dword [esp + 0x1ac], 0x1a6
call fcn.00412626
mov dword [esp + 0x38], 0x4572b4
lea esi, [esp + 0x1a0]
lea edi, [esp + 0x80]
movsd dword es:[edi], dword [esi]
push ecx
lea ecx, [esp + 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00413df3
lea ecx, [esp + 0x38]
call fcn.0041274f
mov edi, dword [esp + 0x18]
jmp 0x40216d
lea eax, [esp + 0x1bc]
push eax
lea eax, [esp + 0x94]
push eax
lea ecx, [esp + 0x230]
call fcn.0040f0e6
push ecx
lea ecx, [esp + 0x22c]
call fcn.00413df3
cmp eax, 1
jne 0x401f13
mov eax, dword [esp + 0x2c0]
mov ebx, dword [eax + 0x80]
jmp 0x401f72
xor ebx, ebx
mov dword [esp + 0x1b4], esi
xor eax, eax
mov dword [esp + 0x1b0], ebx
push str.User_cancelled_installation.
lea ecx, [esp + 0x1a4]
mov word [esp + 0x1a4], ax
mov byte [esp + 0x1bc], bl
call fcn.004011b7
lea eax, [esp + 0x1a0]
push eax
push eax
push 0xe4
push str.wWinMain
push ebx
call fcn.00415994
add esp, 0x14
lea ecx, [esp + 0x1a0]
call fcn.00402499
mov ebx, 0x1f4
lea ecx, [esp + 0x228]
call fcn.0040f32f
jmp 0x40210b
xor ebx, ebx
mov dword [esp + 0x1b4], esi
xor eax, eax
mov dword [esp + 0x1b0], ebx
push str.Installing_in_silent_mode.
lea ecx, [esp + 0x1a4]
mov word [esp + 0x1a4], ax
mov byte [esp + 0x1bc], bl
call fcn.004011b7
lea eax, [esp + 0x1a0]
push eax
push eax
push 0xe8
push str.wWinMain
push ebx
call fcn.00415994
add esp, 0x14
lea ecx, [esp + 0x1a0]
call fcn.00402499
call fcn.0041f106
mov esi, eax
lea ecx, [esp + 0x228]
lea eax, [esp + 0x1bc]
push eax
lea eax, [esp + 0x94]
push eax
push ebx
call fcn.0040701d
push 0x21
push str.make_browser_default_after_import
lea ecx, [esp + 0x1a8]
mov dword [esp + 0x1b8], ebx
mov dword [esp + 0x1bc], 0xf
mov byte [esp + 0x1a8], bl
call fcn.0040256f
lea eax, [esp + 0x1a0]
mov ecx, esi
push eax
call fcn.0041f267
mov bl, al
call fcn.0041a200
movzx edx, byte [esp + 0x244]
cmp eax, 7
movzx ecx, bl
cmovl edx, ecx
lea ecx, [esp + 0x1a0]
mov byte [esp + 0x244], dl
call fcn.00402525
and dword [esp + 0x1b0], 0
lea ecx, [esp + 0x1a0]
push 0xf
pop eax
push eax
push str.send_statistics
mov dword [esp + 0x1bc], eax
mov byte [esp + 0x1a8], 0
call fcn.0040256f
lea eax, [esp + 0x1a0]
mov ecx, esi
push eax
call fcn.0041f267
test al, al
jne 0x4020ba
cmp dword [esp + 0x190], 0
je 0x4020ba
cmp dword [esp + 0x190], 1
jne 0x4020bc
mov al, 1
lea ecx, [esp + 0x1a0]
mov byte [esp + 0x245], al
call fcn.00402525
push dword [esp + 0x2b0]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [esp + 0x2b4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea ecx, [esp + 0x228]
call fcn.004083d5
mov ebx, dword [esp + 0x2a8]
lea ecx, [esp + 0x228]
call fcn.0040749a
push 7
pop esi
and dword [esp + 0x1b0], 0
lea ecx, [esp + 0x1a0]
xor eax, eax
mov dword [esp + 0x1b4], esi
push ebx
push str.Installer_exit_with_code:
mov word [esp + 0x1a8], ax
mov byte [esp + 0x1c0], al
call fcn.004011b7
mov ecx, eax
call fcn.00401263
lea eax, [esp + 0x1a0]
push eax
push eax
push 0xf5
push str.wWinMain
push 0
call fcn.00415994
add esp, 0x14
lea ecx, [esp + 0x1a0]
call fcn.00402499
lea ecx, [esp + 0x1f8]
call fcn.00402525
lea ecx, [esp + 0x90]
call fcn.00404b8b
lea ecx, [esp + 0x1d8]
mov dword [esp + 0x1bc], 0x45714c
call fcn.0040330c
push 0x40
push 1
push dword [esp + 0x1e0]
call fcn.0040110b
add esp, 0xc
lea ecx, [esp + 0x1c0]
call fcn.00402499
lea ecx, [esp + 0x1e0]
call fcn.00402499
lea ecx, [esp + 0x210]
call fcn.00402525
jmp 0x4022b7
xor eax, eax
mov dword [esp + 0x1b0], ebx
push str.Another_installer_instance_is_already_running.
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x1b8], esi
mov word [esp + 0x1a4], ax
mov byte [esp + 0x1bc], bl
call fcn.004011b7
lea eax, [esp + 0x1a0]
push eax
push eax
push 0xa2
push str.wWinMain
push ebx
call fcn.00415994
add esp, 0x14
lea ecx, [esp + 0x1a0]
call fcn.00402499
xor eax, eax
mov dword [esp + 0x1b4], esi
mov esi, dword [section.SHARED]
lea ecx, [esp + 0x1a0]
push str.Master_installer_process_id:
mov dword [esp + 0x1b4], ebx
mov word [esp + 0x1a4], ax
mov byte [esp + 0x1bc], bl
call fcn.004011b7
push esi
mov ecx, eax
call fcn.004012b3
lea eax, [esp + 0x1a0]
push eax
push eax
push 0xa3
push str.wWinMain
push ebx
call fcn.00415994
add esp, 0x14
lea ecx, [esp + 0x1a0]
call fcn.00402499
mov eax, dword [section.SHARED]
test eax, eax
jne 0x4022a6
call fcn.0040da5e
jmp 0x4022b2
push eax
push 0x40be00
call dword [sym.imp.USER32.dll_EnumWindows]
mov ebx, 0x258
cmp byte [esp + 0x12], 0
je 0x4022c5
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test edi, edi
je 0x4022d0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x34]
call dword [sym.imp.gdiplus.dll_GdiplusShutdown]
and dword [esp + 0x34], 0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
jmp 0x402347
xor eax, eax
mov dword [esp + 0x1b0], ebx
push str.Exiting__because_of_insecure_environment.
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x1b8], 7
mov word [esp + 0x1a4], ax
mov byte [esp + 0x1bc], bl
call fcn.004011b7
lea eax, [esp + 0x1a0]
push eax
push eax
push 0x84
push str.wWinMain
push ebx
call fcn.00415994
add esp, 0x14
lea ecx, [esp + 0x1a0]
call fcn.00402499
mov eax, edi
mov ecx, dword [esp + 0x3ac]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00427412
mov esp, ebp
pop ebp
ret 0x10