Function at 0x4026b0
Capabilities:
Create process on windows
Delete file
Enumerate processes
Self delete

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f698
mov eax, dword fs:[0]
push eax
sub esp, 0x4ac
mov eax, dword [0x42e024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x10]
lea ecx, [ebp - 0xe8]
xor eax, eax
mov dword [ebp - 0x3dc], esi
mov dword [ebp - 0x3ec], eax
mov dword [ebp - 0x3f0], eax
call fcn.0040d110
push 0x64
mov dword [ebp - 4], 0
call fcn.0041e041
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xe8]
cmp dword [ebp - 0xd4], 0x10
cmovae ecx, dword [ebp - 0xe8]
sub esp, 8
push ecx
mov ecx, eax
call fcn.004052a0
mov edi, eax
mov byte [ebp - 4], 0
mov eax, dword [0x42e948]
test eax, eax
jne 0x402779
push 0x1c
call fcn.0041e041
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 2
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov ecx, eax
movq qword [eax + 0x10], xmm0
mov dword [eax + 0x18], 0
call fcn.00406a80
mov byte [ebp - 4], 0
mov dword [0x42e948], eax
mov edx, dword [eax]
mov ecx, eax
push edi
call dword [edx + 0x10]
mov edi, esi
mov byte [ebp - 0x3f4], 1
xor al, al
mov dword [ebp - 0x3e8], eax
mov byte [ebp - 0x3d5], al
lea ecx, [edi + 2]
nop dword [eax + eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4027a0
sub edi, ecx
sar edi, 1
lea esi, [edi + 1]
push esi
call fcn.0041e087
push esi
push 0
push eax
mov dword [ebp - 0x3f0], eax
call sub.VCRUNTIME140.dll_memset
mov esi, dword [ebp - 0x3f0]
push edi
push dword [ebp - 0x3dc]
push esi
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs]
add esp, 0x1c
mov dword [ebp - 0x5c], 0xf
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x60], 0
mov byte [ebp - 0x70], 0
push 0
push 0x4234f6
call fcn.00404270
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x88]
push 0
push 0x4234f6
mov dword [ebp - 0x74], 0xf
mov dword [ebp - 0x78], 0
mov byte [ebp - 0x88], 0
call fcn.00404270
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa0]
push 0
push 0x4234f6
mov dword [ebp - 0x8c], 0xf
mov dword [ebp - 0x90], 0
mov byte [ebp - 0xa0], 0
call fcn.00404270
push 0x42350c
mov byte [ebp - 4], 5
push esi
mov dword [ebp - 0x18], 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov esi, eax
add esp, 8
test esi, esi
je 0x402a57
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
xor eax, eax
push esi
push eax
push str._d__token__s
push str.post_install
call fcn.00402620
push 4
push str.exe
push esi
call edi
add esp, 0x1c
test eax, eax
jne 0x4028dc
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esi + 4]
mov edx, ecx
lea esi, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x4028c0
sub edx, esi
cmp edx, 3
jbe 0x402a36
call fcn.0040a430
jmp 0x402a36
push 5
push str.inst
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x402928
add esi, 5
cmp byte [esi], al
jne 0x402905
xor ecx, ecx
push ecx
push esi
lea ecx, [ebp - 0x70]
call fcn.00404270
jmp 0x402a36
mov ecx, esi
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402910
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x70]
call fcn.00404270
jmp 0x402a36
push 2
push 0x423540
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x40295b
lea eax, [esi + 2]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
cmp eax, 1
jne 0x402a36
mov byte [ebp - 0x3f4], 0
jmp 0x402a36
push 2
push 0x423544
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x4029ab
add esi, 2
cmp byte [esi], al
jne 0x402987
xor ecx, ecx
push ecx
push esi
lea ecx, [ebp - 0x88]
call fcn.00404270
jmp 0x402a36
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402990
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x88]
call fcn.00404270
jmp 0x402a36
push 2
push 0x423548
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x4029f8
add esi, 2
cmp byte [esi], al
jne 0x4029d4
xor ecx, ecx
push ecx
push esi
lea ecx, [ebp - 0xa0]
call fcn.00404270
jmp 0x402a36
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4029e0
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0xa0]
call fcn.00404270
jmp 0x402a36
push 2
push 0x42354c
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x402a36
lea eax, [esi + 2]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, dword [ebp - 0x3e8]
add esp, 4
cmp eax, 1
movzx ecx, cl
mov eax, 1
cmove ecx, eax
mov dword [ebp - 0x3e8], ecx
mov byte [ebp - 0x3d5], cl
push 0x42350c
push 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov esi, eax
add esp, 8
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
test esi, esi
jne 0x402887
push dword [ebp - 0x3f0]
call fcn.0041e03c
add esp, 4
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
push eax
push str.Ole_init_result:__d
push str.post_install
call fcn.00402620
mov edi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
lea eax, [ebp - 0x1a8]
push eax
push str.shutdown.dat
call edi
add esp, 0x14
test eax, eax
jne 0x402ab6
push str.shutdown.dat
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
push eax
push str.delete_shutdown.dat:__d
push str.post_install
call fcn.00402620
add esp, 0x10
lea ecx, [ebp - 0x28]
call fcn.00408300
test eax, eax
je 0x402b65
push 8
push str.inst.dat
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 0xf
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
call fcn.00404270
mov byte [ebp - 4], 6
lea esi, [ebp - 0x40]
mov ax, word [0x42705c]
cmp dword [ebp - 0x2c], 0x10
mov word [ebp - 0x18], ax
mov al, byte [0x42705e]
cmovae esi, dword [ebp - 0x40]
mov byte [ebp - 0x16], al
lea eax, [ebp - 0x1a8]
push eax
push esi
mov byte [ebp - 0x18], 0x77
call edi
add esp, 8
lea edx, [ebp - 0x18]
mov ecx, esi
call fcn.0040a4b0
mov ecx, dword [ebp - 0x24]
mov esi, eax
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ecx
mov ecx, esi
mov edx, dword [esi]
push 1
push 8
push eax
call dword [edx + 0x1c]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x402b65
inc eax
push eax
push dword [ebp - 0x40]
call fcn.00404770
call dword [sym.imp.ole32.dll_OleUninitialize]
cmp dword [ebp - 0x5c], 0x10
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
push eax
push str.Install_path:__s
push str.post_install
call fcn.00402620
mov eax, dword [ebp - 0x3e8]
movzx eax, al
push eax
push str.Reinstall_:__d
push str.post_install
call fcn.00402620
push 0x88
mov byte [ebp - 4], 7
call fcn.0041e041
mov esi, eax
add esp, 0x1c
mov dword [ebp - 0x1c], esi
push 0x88
push 0
push esi
mov byte [ebp - 4], 8
call sub.VCRUNTIME140.dll_memset
add esp, 8
mov ecx, esi
call fcn.0040cae0
mov esi, eax
mov byte [ebp - 4], 7
mov ecx, esi
mov dword [ebp - 0x3dc], esi
mov dword [ebp - 0x3e8], esi
call fcn.0040df50
mov ecx, esi
call fcn.0040e9b0
mov ecx, esi
call fcn.0040d4f0
mov ecx, esi
call fcn.00411e20
mov ecx, esi
call fcn.00411cd0
test al, al
jne 0x402c1b
push str.Failed_to_launch_Update_Service
push str.post_install
call fcn.00402590
add esp, 8
sub esp, 0x18
mov ecx, esi
mov eax, esp
push 4
push eax
call fcn.0040d1a0
call fcn.004122d0
add esp, 0x18
push str.GlobalExit_7a176276_e800_4daa_b5e8_7febbd3efc4a
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x3e0], eax
test eax, eax
je 0x402c64
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
push eax
call edi
push dword [ebp - 0x3e0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402c83
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.cannot_initialized_app_exit_event___d_
push str.stealth_manager
call fcn.00402590
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
add esp, 0xc
sub esp, 0x18
mov ecx, esi
mov eax, esp
push 0xa
push eax
call fcn.0040d1a0
call fcn.004122d0
add esp, 0x18
mov ecx, esi
sub esp, 0x18
mov eax, esp
push 0x11
push eax
call fcn.0040d1a0
call fcn.004122d0
add esp, 0x18
push str.GlobalExit_7a176276_e800_4daa_b5e8_7febbd3efc4a
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x3e0], eax
test eax, eax
jne 0x402ce7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.cannot_initialized_app_exit_event___d_
push str.uninstall_util
call fcn.00402590
add esp, 0xc
jmp 0x402d01
push eax
call edi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x3e0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00418220
push str.GlobalKNIT_NFS_EXIT_CD1DF70D_8191_4840_B884_76C2620B8ED3
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x3e0], eax
test eax, eax
jne 0x402d42
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.cannot_initialize_network_exit_event___d_
push str.uninstall_util
call fcn.00402590
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
jmp 0x402d5e
push eax
call edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call edi
push dword [ebp - 0x3e0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call edi
sub esp, 0x18
mov ecx, esi
mov eax, esp
push 4
push eax
call fcn.0040d1a0
call fcn.00412100
add esp, 0x18
mov ecx, esi
sub esp, 0x18
mov eax, esp
push 0xa
push eax
call fcn.0040d1a0
call fcn.00412100
add esp, 0x18
mov ecx, esi
call fcn.00410e10
push 0x1f4
call edi
xorps xmm0, xmm0
push 0
movq qword [ebp - 0x28], xmm0
push 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.00404e60
mov edi, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x28], edi
push 0
push 2
mov byte [ebp - 4], 9
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x3e0], eax
cmp eax, 0xffffffff
je 0x4031eb
lea ecx, [ebp - 0x3d4]
mov dword [ebp - 0x3d4], 0x22c
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x403122
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
cmp word [ebp - 0x3b0], ax
jne 0x402e31
xor ecx, ecx
jmp 0x402e4f
lea ecx, [ebp - 0x3b0]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402e40
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x3b0]
push eax
lea ecx, [ebp - 0x40]
call fcn.004040e0
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x58]
call fcn.00406f70
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x402e84
inc eax
push eax
push dword [ebp - 0x40]
call fcn.00404710
mov esi, dword [ebp - 0x44]
lea ecx, [ebp - 0x58]
mov edx, dword [ebp - 0x58]
lea edi, [ebp - 0x58]
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
cmp esi, 0x10
lea eax, [ebp - 0x58]
mov dword [ebp - 0x30], 0
cmovae eax, edx
cmovae ecx, edx
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0x48]
add eax, ecx
cmp esi, 0x10
mov dword [ebp - 0x1c], eax
cmovae edi, edx
cmp edi, eax
je 0x402eec
movsx eax, byte [edi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov ecx, eax
add esp, 4
mov eax, dword [ebp - 0x3f0]
inc edi
mov byte [eax], cl
inc eax
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0x1c]
jmp 0x402ec4
mov esi, dword [ebp - 0x3dc]
lea eax, [ebp - 0x190]
push 9
push eax
mov ecx, esi
call fcn.0040d1a0
mov byte [ebp - 4], 0xd
lea edx, [eax + 0x10]
mov edi, dword [ebp - 0x3ec]
or edi, 1
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0x3ec], edi
mov dword [ebp - 0x3f0], edi
jb 0x402f26
mov eax, dword [eax]
push dword [edx]
cmp dword [ebp - 0x44], 0x10
lea ecx, [ebp - 0x58]
mov edx, dword [ebp - 0x48]
cmovae ecx, dword [ebp - 0x58]
push eax
call fcn.004041e0
add esp, 8
test eax, eax
je 0x402fdd
push 3
lea eax, [ebp - 0x40c]
mov ecx, esi
push eax
call fcn.0040d1a0
mov dword [ebp - 4], 0xe
lea edx, [eax + 0x10]
or edi, 2
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0x3ec], edi
mov dword [ebp - 0x3f0], edi
jb 0x402f78
mov eax, dword [eax]
push dword [edx]
cmp dword [ebp - 0x44], 0x10
lea ecx, [ebp - 0x58]
mov edx, dword [ebp - 0x48]
cmovae ecx, dword [ebp - 0x58]
push eax
call fcn.004041e0
add esp, 8
test eax, eax
je 0x402fdd
push 0x10
lea eax, [ebp - 0xb8]
mov ecx, esi
push eax
call fcn.0040d1a0
or edi, 4
mov dword [ebp - 0x3ec], edi
cmp dword [eax + 0x14], 0x10
lea edx, [eax + 0x10]
jb 0x402fb9
mov eax, dword [eax]
push dword [edx]
cmp dword [ebp - 0x44], 0x10
lea ecx, [ebp - 0x58]
mov edx, dword [ebp - 0x48]
cmovae ecx, dword [ebp - 0x58]
push eax
call fcn.004041e0
add esp, 8
mov byte [ebp - 0x3e1], 0
test eax, eax
jne 0x402fe4
mov byte [ebp - 0x3e1], 1
mov eax, dword [ebp - 0x3ec]
test al, 4
je 0x403032
mov ecx, dword [ebp - 0xa4]
and eax, 0xfffffffb
mov dword [ebp - 0x3ec], eax
cmp ecx, 0x10
jb 0x403017
lea eax, [ecx + 1]
push eax
push dword [ebp - 0xb8]
call fcn.00404770
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0xa4], 0xf
mov dword [ebp - 0xa8], 0
mov byte [ebp - 0xb8], 0
test al, 2
je 0x40307a
mov ecx, dword [ebp - 0x3f8]
and eax, 0xfffffffd
mov dword [ebp - 0x3ec], eax
cmp ecx, 0x10
jb 0x40305f
lea eax, [ecx + 1]
push eax
push dword [ebp - 0x40c]
call fcn.00404770
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x3f8], 0xf
mov dword [ebp - 0x3fc], 0
mov byte [ebp - 0x40c], 0
and eax, 0xfffffffe
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x17c]
cmp eax, 0x10
jb 0x4030a2
inc eax
push eax
push dword [ebp - 0x190]
call fcn.00404770
cmp byte [ebp - 0x3e1], 0
je 0x4030ee
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x3cc]
push eax
push dword [esi + 4]
push esi
call fcn.004050c0
mov edx, dword [ebp - 0x24]
mov ecx, 0x15555554
sub ecx, edx
mov edi, eax
cmp ecx, 1
jae 0x4030da
push str.list_T__too_long
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const__]
mov dword [esi + 4], edi
inc edx
mov eax, dword [edi + 4]
mov dword [ebp - 0x24], edx
mov dword [eax], edi
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x18], edi
jmp 0x4030f1
mov edi, dword [ebp - 0x18]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x44]
cmp eax, 0x10
jb 0x403107
inc eax
push eax
push dword [ebp - 0x58]
call fcn.00404770
lea eax, [ebp - 0x3d4]
push eax
push dword [ebp - 0x3e0]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x402e10
push dword [ebp - 0x3e0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [edi]
cmp esi, edi
je 0x4031e5
push 0x14
call fcn.0041e087
mov edi, eax
add esp, 4
xorps xmm0, xmm0
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
push dword [esi + 8]
push 0x4235e0
push edi
call fcn.00402330
add esp, 0xc
mov dword [ebp - 0x2c], 0xf
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
push 0x11
push str.taskkill__F__PID
call fcn.00404270
mov byte [ebp - 4], 0xf
cmp byte [edi], 0
jne 0x403190
xor ecx, ecx
jmp 0x40319e
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403195
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x40]
call fcn.00404490
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
push 0
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push edi
call fcn.0041e03c
mov byte [ebp - 4], 9
add esp, 4
mov eax, dword [ebp - 0x2c]
cmp eax, 0x10
jb 0x4031db
inc eax
push eax
push dword [ebp - 0x40]
call fcn.00404770
mov esi, dword [esi]
mov edi, dword [ebp - 0x18]
jmp 0x403130
mov esi, dword [ebp - 0x3dc]
call fcn.00418470
mov eax, 1
mov dword [ebp - 0x3dc], eax
cmp eax, 3
jg 0x40322b
mov ecx, esi
call fcn.00413ad0
test al, al
jne 0x40322b
push str.retry_cp_dll
push str.post_install
call fcn.00402620
add esp, 8
call fcn.00418470
mov eax, dword [ebp - 0x3dc]
inc eax
jmp 0x4031f5
mov ecx, esi
call fcn.00412680
mov ecx, esi
call fcn.00412f50
mov ecx, esi
call fcn.004149a0
test al, al
jne 0x403256
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, esi
call fcn.004149a0
mov ecx, esi
call fcn.00414510
test al, al
jne 0x403273
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, esi
call fcn.00414510
mov dword [ebp - 0x18], 0
nop word [eax + eax]
mov ecx, esi
mov byte [ebp - 4], 0x10
call fcn.00411820
mov dword [ebp - 4], 9
jmp 0x4032d5
mov dword [ebp - 0x18], 0
nop dword [eax]
mov ecx, esi
mov byte [ebp - 4], 0x15
call fcn.00411160
mov dword [ebp - 4], 9
jmp 0x40344e
mov dword [ebp - 0x18], 0
mov ecx, esi
mov byte [ebp - 4], 0x1a
call fcn.00410b50
mov dword [ebp - 4], 9
jmp 0x403596
sub esp, 0x18
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x4036ad
mov eax, dword [ecx]
jmp 0x4036af
mov eax, ecx
push 0xffffffffffffffff
push 0
push 0x42ee18
mov byte [eax], 0
call fcn.00404370
call fcn.00417120
add esp, 0x18
lea eax, [ebp - 0x40c]
mov ecx, esi
push 6
push eax
call fcn.0040d1a0
push 0x423638
mov edx, eax
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xb8]
call fcn.00404f40
add esp, 4
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x3f8]
cmp eax, 0x10
jb 0x40370d
inc eax
push eax
push dword [ebp - 0x40c]
call fcn.00404770
push 0x28
mov dword [ebp - 0x3f8], 0xf
mov dword [ebp - 0x3fc], 0
mov byte [ebp - 0x40c], 0
call fcn.0041e041
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x3dc], eax
xorps xmm0, xmm0
mov byte [ebp - 4], 0x22
sub esp, 0x18
lea edx, [ebp - 0xb8]
movups xmmword [eax], xmm0
mov ecx, esp
movups xmmword [eax + 0x10], xmm0
push str.lic.dat
movq qword [eax + 0x20], xmm0
call fcn.00404f90
mov ecx, dword [ebp - 0x1c]
add esp, 4
call fcn.00419070
mov ecx, eax
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
mov dword [ebp - 0x3e0], eax
call fcn.00418d40
push eax
push str.STARTUP_GU_TYPE_:__d
push str.post_install
mov dword [ebp - 0x3dc], eax
call fcn.00402620
mov eax, dword [ebp - 0x3dc]
add esp, 0xc
test eax, eax
jne 0x4037db
mov eax, dword [ebp - 0x3e0]
cmp dword [eax + 8], 0
je 0x4037ec
mov ecx, 1
call fcn.00418ed0
push 1
push str.STARTUP_SET_GU_TYPE_:__d
push str.post_install
call fcn.00402620
mov eax, dword [ebp - 0x3dc]
add esp, 0xc
cmp eax, 1
jne 0x40380a
mov eax, dword [ebp - 0x3e0]
cmp dword [eax + 8], 0
jne 0x40380a
mov ecx, 2
call fcn.00418ed0
push 2
push str.STARTUP_SET_GU_TYPE_:__d
push str.post_install
call fcn.00402620
add esp, 0xc
mov ecx, dword [ebp - 0x1c]
push 1
mov eax, dword [ecx]
call dword [eax + 0x14]
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0xa4]
cmp eax, 0x10
jb 0x403830
inc eax
push eax
push dword [ebp - 0xb8]
call fcn.00404770
movzx eax, byte [ebp - 0x3f4]
push eax
push str.Show_dialog:__d
push str.post_install
call fcn.00402620
add esp, 0xc
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1c], esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x403878
mov eax, dword [ecx]
jmp 0x40387a
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0xa0]
push 0
push eax
call fcn.00404370
sub esp, 0x18
mov byte [ebp - 4], 0x23
mov ecx, esp
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x14], 0xf
cmp dword [ecx + 0x14], 0x10
mov dword [ecx + 0x10], 0
jb 0x4038bc
mov eax, dword [ecx]
jmp 0x4038be
mov eax, ecx
push 0xffffffffffffffff
mov byte [eax], 0
lea eax, [ebp - 0x88]
push 0
push eax
call fcn.00404370
push dword [ebp - 0x3f4]
mov ecx, esi
mov byte [ebp - 4], 9
call fcn.00411510
test al, al
jne 0x4038f8
push str.Failed_to_launch_startup_service
push str.post_install
call fcn.00402590
add esp, 8
mov ecx, esi
call fcn.00411b20
test al, al
jne 0x403915
push str.Failed_to_launch_process_monitor
push str.post_install
call fcn.00402590
add esp, 8
mov ecx, esi
call fcn.00410fb0
test al, al
jne 0x403932
push str.Failed_to_launch_system_service
push str.post_install
call fcn.00402590
add esp, 8
mov ecx, esi
call fcn.00411430
test esi, esi
je 0x403952
mov ecx, esi
call fcn.0040cee0
push 0x88
push esi
call fcn.0041e079
add esp, 8
mov eax, dword [edi]
mov dword [edi], edi
mov dword [edi + 4], edi
cmp eax, edi
je 0x403971
nop dword [eax]
mov esi, dword [eax]
push eax
call fcn.0041e074
add esp, 4
mov eax, esi
cmp esi, edi
jne 0x403960
push edi
call fcn.0041e074
add esp, 4
mov eax, dword [ebp - 0x8c]
mov esi, 1
cmp eax, 0x10
jb 0x403997
inc eax
push eax
push dword [ebp - 0xa0]
call fcn.00404770
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x8c], 0xf
mov dword [ebp - 0x90], 0
mov byte [ebp - 0xa0], 0
cmp eax, 0x10
jb 0x4039c7
inc eax
push eax
push dword [ebp - 0x88]
call fcn.00404770
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x74], 0xf
mov dword [ebp - 0x78], 0
mov byte [ebp - 0x88], 0
cmp eax, 0x10
jb 0x4039ee
inc eax
push eax
push dword [ebp - 0x70]
call fcn.00404770
mov ecx, dword [ebp - 0xd4]
mov dword [ebp - 0x5c], 0xf
mov dword [ebp - 0x60], 0
mov byte [ebp - 0x70], 0
cmp ecx, 0x10
jb 0x403a18
inc ecx
push ecx
push dword [ebp - 0xe8]
call fcn.00404770
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e02b
mov esp, ebp
pop ebp
ret 0x10