Function at 0x41a170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b4c15
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x51c0b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0
lea eax, [ebp - 0x281]
mov dword [ebp - 0xd0], 0x4dd804
push eax
push str.SETUPSUPPORTDIR
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xa8], 0x4dcac4
call fcn.004042c0
mov dword [ebp - 4], 1
lea ebx, [esi + 0x284]
mov edx, dword [ebx]
lea eax, [esi + 0x3b8]
push eax
lea eax, [ebp - 0xd0]
mov ecx, ebx
push eax
call dword [edx + 4]
lea eax, [ebp - 0xd0]
mov ecx, ebx
push eax
call fcn.00459a60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd0]
call fcn.00404db0
push 0
lea eax, [ebp - 0x281]
mov dword [ebp - 0x100], 0x4dd804
push eax
push str.ProgramFilesFolder
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xd8], 0x4dcac4
call fcn.004042c0
mov dword [ebp - 4], 4
xor edx, edx
lea ecx, [ebp - 0xd0]
call fcn.00434a10
mov byte [ebp - 4], 5
mov ecx, ebx
mov edx, dword [ebx]
push eax
lea eax, [ebp - 0x100]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x100]
mov ecx, ebx
push eax
call fcn.00459a60
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xd0]
call fcn.00404db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x100]
call fcn.00404db0
push 0
lea eax, [ebp - 0x281]
mov dword [ebp - 0x130], 0x4dd804
push eax
push str.CommonFilesFolder
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x108], 0x4dcac4
call fcn.004042c0
mov dword [ebp - 4], 0xa
mov edx, 1
lea ecx, [ebp - 0x100]
call fcn.00434a10
mov byte [ebp - 4], 0xb
mov edx, dword [ebx]
push eax
lea eax, [ebp - 0x130]
push eax
mov ecx, ebx
call dword [edx + 4]
lea eax, [ebp - 0x130]
mov ecx, ebx
push eax
call fcn.00459a60
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x100]
call fcn.00404db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x130]
call fcn.00404db0
push 0
lea eax, [ebp - 0x281]
mov dword [ebp - 0x160], 0x4dd804
push eax
push str.WindowsFolder
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x138], 0x4dcac4
call fcn.004042c0
mov dword [ebp - 4], 0x10
lea eax, [ebp - 0x130]
push 0
push eax
call fcn.004348b0
add esp, 8
mov byte [ebp - 4], 0x11
mov ecx, ebx
mov edx, dword [ebx]
push eax
lea eax, [ebp - 0x160]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x160]
mov ecx, ebx
push eax
call fcn.00459a60
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x130]
call fcn.00404db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.00404db0
push 0
lea eax, [ebp - 0x281]
mov dword [ebp - 0x190], 0x4dd804
push eax
push str.SystemFolder
lea ecx, [ebp - 0x190]
mov dword [ebp - 0x168], 0x4dcac4
call fcn.004042c0
mov dword [ebp - 4], 0x16
lea eax, [ebp - 0x160]
push 0
push eax
call fcn.00434660
add esp, 8
mov byte [ebp - 4], 0x17
mov ecx, ebx
mov edx, dword [ebx]
push eax
lea eax, [ebp - 0x190]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x190]
mov ecx, ebx
push eax
call fcn.00459a60
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x160]
call fcn.00404db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x190]
call fcn.00404db0
push 0
lea eax, [ebp - 0x281]
mov dword [ebp - 0x1c0], 0x4dd804
push eax
push str.System64Folder
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x198], 0x4dcac4
call fcn.004042c0
mov dword [ebp - 4], 0x1c
lea eax, [ebp - 0x190]
push 0
push eax
call fcn.00434660
add esp, 8
mov byte [ebp - 4], 0x1d
mov ecx, ebx
mov edx, dword [ebx]
push eax
lea eax, [ebp - 0x1c0]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x1c0]
mov ecx, ebx
push eax
call fcn.00459a60
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x190]
call fcn.00404db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c0]
call fcn.00404db0
push 0
lea eax, [ebp - 0x281]
mov dword [ebp - 0x1f0], 0x4dd804
push eax
push str.LocalAppDataFolder
lea ecx, [ebp - 0x1f0]
mov dword [ebp - 0x1c8], 0x4dcac4
call fcn.004042c0
mov dword [ebp - 4], 0x22
mov edx, 0x1c
lea ecx, [ebp - 0x1c0]
call fcn.00416000
mov byte [ebp - 4], 0x23
mov ecx, ebx
mov edx, dword [ebx]
push eax
lea eax, [ebp - 0x1f0]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x1f0]
mov ecx, ebx
push eax
call fcn.00459a60
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x1c0]
call fcn.00404db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f0]
call fcn.00404db0
mov dword [ebp - 0x220], 0x4dd804
push 0
lea eax, [ebp - 0x281]
mov dword [ebp - 0x1f8], 0x4dcac4
push eax
push str.PersonalFolder
lea ecx, [ebp - 0x220]
call fcn.004042c0
mov dword [ebp - 4], 0x27
mov edx, 5
lea ecx, [ebp - 0x1f0]
call fcn.00416000
mov byte [ebp - 4], 0x28
mov ecx, ebx
mov edx, dword [ebx]
push eax
lea eax, [ebp - 0x220]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x220]
mov ecx, ebx
push eax
call fcn.00459a60
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x1f0]
call fcn.00404db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.00404db0
push 0
lea eax, [ebp - 0x281]
mov dword [ebp - 0x250], 0x4dd804
push eax
push str.CommonDocuments
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x228], 0x4dcac4
call fcn.004042c0
mov dword [ebp - 4], 0x2c
mov edx, 0x2e
lea ecx, [ebp - 0x220]
call fcn.00416000
mov byte [ebp - 4], 0x2d
mov ecx, ebx
mov edx, dword [ebx]
push eax
lea eax, [ebp - 0x250]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x250]
mov ecx, ebx
push eax
call fcn.00459a60
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x220]
call fcn.00404db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x250]
call fcn.00404db0
push 0
lea eax, [ebp - 0x281]
mov dword [ebp - 0x280], 0x4dd804
push eax
push str.CommonAppDataFolder
lea ecx, [ebp - 0x280]
mov dword [ebp - 0x258], 0x4dcac4
call fcn.004042c0
mov dword [ebp - 4], 0x31
mov edx, 0x23
lea ecx, [ebp - 0x250]
call fcn.00416000
mov byte [ebp - 4], 0x32
mov ecx, ebx
mov edx, dword [ebx]
push eax
lea eax, [ebp - 0x280]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x280]
mov ecx, ebx
push eax
call fcn.00459a60
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x250]
call fcn.00404db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x280]
call fcn.00404db0
push 0
lea eax, [ebp - 0x281]
mov dword [ebp - 0xa0], 0x4dd804
push eax
push str.AppDataFolder
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x78], 0x4dcac4
call fcn.004042c0
mov dword [ebp - 4], 0x36
mov edx, 0x1a
lea ecx, [ebp - 0x280]
call fcn.00416000
mov byte [ebp - 4], 0x37
mov ecx, ebx
mov edx, dword [ebx]
push eax
lea eax, [ebp - 0xa0]
push eax
call dword [edx + 4]
lea eax, [ebp - 0xa0]
mov ecx, ebx
push eax
call fcn.00459a60
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x280]
call fcn.00404db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.00404db0
push 0
lea eax, [ebp - 0x281]
mov dword [ebp - 0x70], 0x4dd804
push eax
push str.AdminToolsFolder
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x48], 0x4dcac4
call fcn.004042c0
mov dword [ebp - 4], 0x3b
mov edx, 0x30
lea ecx, [ebp - 0xa0]
call fcn.00416000
mov byte [ebp - 4], 0x3c
mov ecx, ebx
mov edx, dword [ebx]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x70]
mov ecx, ebx
push eax
call fcn.00459a60
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0xa0]
call fcn.00404db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.00404db0
push 0
lea eax, [ebp - 0x281]
mov dword [ebp - 0x40], 0x4dd804
push eax
push str.TempFolder
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x18], 0x4dcac4
call fcn.004042c0
mov dword [ebp - 4], 0x40
lea ecx, [ebp - 0x70]
call fcn.00434470
mov byte [ebp - 4], 0x41
mov ecx, ebx
mov edx, dword [ebx]
push eax
lea eax, [ebp - 0x40]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x40]
mov ecx, ebx
push eax
call fcn.00459a60
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x70]
call fcn.00404db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00404db0
call fcn.00492a05
test al, al
je 0x41aa7d
mov ecx, esi
call fcn.00422c40
mov esi, eax
test esi, esi
je 0x41aa7d
push 0x18
call fcn.004996e0
mov edi, eax
add esp, 4
xor eax, eax
mov ecx, esi
mov dword [edi + 0x14], eax
push 0x18
push edi
mov dword [edi], 7
mov dword [edi + 4], eax
mov dword [edi + 8], 4
mov dword [edi + 0xc], eax
push 1
mov dword [edi + 0x10], eax
call fcn.00471000
mov dword [ebp - 0x288], eax
test eax, eax
jne 0x41a8aa
mov ecx, esi
call fcn.00470f10
test eax, eax
jne 0x41a8a0
cmp dword [esi + 8], eax
je 0x41a895
cmp dword [esi + 0x1c], eax
je 0x41a8a0
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x41a8a0
mov eax, dword [eax]
jmp 0x41a8bb
mov dword [ebp - 0x288], 0xe9
push 0x14
push edi
call fcn.00499db8
mov eax, dword [ebp - 0x288]
add esp, 8
test eax, eax
jne 0x41a963
mov ecx, dword [esi + 0x1c]
mov eax, dword [ecx + 4]
test eax, eax
je 0x41a963
push 0
shr eax, 1
lea edx, [ebp - 0x281]
push edx
push eax
add ecx, 8
mov dword [ebp - 0x70], 0x4dd804
mov eax, 0x4d7438
mov dword [ebp - 0x48], 0x4dcac4
cmovne eax, ecx
lea ecx, [ebp - 0x70]
push eax
call fcn.00407090
mov dword [ebp - 4], 0x46
lea eax, [ebp - 0x281]
push 0
push eax
push str.ProgramFiles64Folder
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 0x4dd804
mov dword [ebp - 0x18], 0x4dcac4
call fcn.004042c0
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x70]
mov eax, dword [ebx]
push ecx
lea ecx, [ebp - 0x40]
push ecx
mov ecx, ebx
call dword [eax + 4]
lea eax, [ebp - 0x40]
mov ecx, ebx
push eax
call fcn.00459a60
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x40]
call fcn.00404db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.00404db0
push 0x18
call fcn.004996e0
mov edi, eax
add esp, 4
xor eax, eax
mov ecx, esi
mov dword [edi + 0x14], eax
push 0x18
push edi
mov dword [edi], 7
mov dword [edi + 4], eax
mov dword [edi + 8], 4
mov dword [edi + 0xc], eax
push 1
mov dword [edi + 0x10], 1
call fcn.00471000
mov dword [ebp - 0x288], eax
test eax, eax
jne 0x41a9ce
mov ecx, esi
call fcn.00470f10
test eax, eax
jne 0x41a9c4
cmp dword [esi + 8], eax
je 0x41a9b9
cmp dword [esi + 0x1c], eax
je 0x41a9c4
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x41a9c4
mov eax, dword [eax]
jmp 0x41a9df
mov dword [ebp - 0x288], 0xe9
push 0x14
push edi
call fcn.00499db8
mov eax, dword [ebp - 0x288]
add esp, 8
test eax, eax
jne 0x41ab5c
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41ab5c
shr ecx, 1
lea edx, [ebp - 0x281]
push 0
push edx
push ecx
add eax, 8
mov dword [ebp - 0x70], 0x4dd804
mov ecx, 0x4d7438
mov dword [ebp - 0x48], 0x4dcac4
cmovne ecx, eax
push ecx
lea ecx, [ebp - 0x70]
call fcn.00407090
mov dword [ebp - 4], 0x4c
lea eax, [ebp - 0x281]
push 0
push eax
push str.CommonFiles64Folder
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 0x4dd804
mov dword [ebp - 0x18], 0x4dcac4
call fcn.004042c0
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x70]
mov eax, dword [ebx]
push ecx
lea ecx, [ebp - 0x40]
push ecx
mov ecx, ebx
call dword [eax + 4]
lea eax, [ebp - 0x40]
mov ecx, ebx
push eax
call fcn.00459a60
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x40]
call fcn.00404db0
jmp 0x41ab4d
push 0
lea eax, [ebp - 0x281]
mov dword [ebp - 0x40], 0x4dd804
push eax
push str.ProgramFiles64Folder
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x18], 0x4dcac4
call fcn.004042c0
mov dword [ebp - 4], 0x52
xor edx, edx
lea ecx, [ebp - 0xa0]
call fcn.00434a10
mov byte [ebp - 4], 0x53
mov ecx, ebx
mov edx, dword [ebx]
push eax
lea eax, [ebp - 0x40]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x40]
mov ecx, ebx
push eax
call fcn.00459a60
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0xa0]
call fcn.00404db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.00404db0
push 0
lea eax, [ebp - 0x281]
mov dword [ebp - 0x70], 0x4dd804
push eax
push str.CommonFiles64Folder
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x48], 0x4dcac4
call fcn.004042c0
mov dword [ebp - 4], 0x58
mov edx, 1
lea ecx, [ebp - 0x40]
call fcn.00434a10
mov byte [ebp - 4], 0x59
mov ecx, ebx
mov edx, dword [ebx]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x70]
mov ecx, ebx
push eax
call fcn.00459a60
mov byte [ebp - 4], 0x58
lea ecx, [ebp - 0x40]
call fcn.00404db0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.00404db0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004996ca
mov esp, ebp
pop ebp
ret