Function at 0x406490
Capabilities:
Create process on windows
Move file
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x44b7e6
mov eax, dword fs:[0]
push eax
sub esp, 0x790
mov eax, dword [0x45e520]
xor eax, esp
mov dword [esp + 0x788], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45e520]
xor eax, esp
push eax
lea eax, [esp + 0x7a4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x7b4]
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov esi, ecx
mov ebp, 0xf
push eax
lea ecx, [esp + 0xf4]
mov dword [esp + 0x10c], ebp
mov dword [esp + 0x108], ebx
mov byte [esp + 0xf8], bl
call fcn.00402280
push 0xffffffffffffffff
mov dword [esp + 0x7b0], ebx
push ebx
push esi
lea ecx, [esp + 0xa0]
mov dword [esp + 0xb8], ebp
mov dword [esp + 0xb4], ebx
mov byte [esp + 0xa4], bl
call fcn.00402280
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x7b0], 1
call fcn.00406200
push 0x103
lea ecx, [esp + 0x489]
push ebx
mov byte [esp + 0x7b4], 2
push ecx
mov byte [esp + 0x490], bl
call fcn.00436440
mov esi, dword [esp + 0x30]
lea eax, [esp + 0x490]
mov ecx, eax
add esp, 0xc
mov edx, 0x104
sub esi, ecx
mov cl, byte [eax + esi]
cmp cl, bl
je 0x40658a
mov byte [eax], cl
add eax, 1
sub edx, 1
jne 0x406577
jmp 0x40658e
cmp edx, ebx
jne 0x406591
sub eax, 1
mov byte [eax], bl
sub esp, 0x1c
mov esi, esp
lea eax, [esp + 0x4a0]
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], ebx
mov dword [esp + 0x38], esp
mov byte [esi + 4], bl
lea edi, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4065b0
sub eax, edi
push eax
lea edx, [esp + 0x4a4]
push edx
mov ecx, esi
call fcn.004024f0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
mov byte [esp + 0x7e4], 3
push 4
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push 0x4529b8
mov byte [ecx + 4], bl
call fcn.004024f0
mov byte [esp + 0x7e4], 2
call fcn.004041e0
lea eax, [esp + 0x484]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x406697
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 4
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push str.fail
mov byte [ecx + 4], bl
call fcn.004024f0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x4c], esp
mov byte [esp + 0x7e4], 4
push 0x11
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push str.PathIsDirectory__
mov byte [ecx + 4], bl
call fcn.004024f0
mov byte [esp + 0x7e4], 2
call fcn.004041e0
mov byte [esp + 0x7ac], 1
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40668d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, 0x10
jmp 0x40757c
push 0xc
push str.ZDUpdate.exe
lea ecx, [esp + 0xb8]
mov dword [esp + 0x1c], 1
mov dword [esp + 0xd0], ebp
mov dword [esp + 0xcc], ebx
mov byte [esp + 0xbc], bl
call fcn.004024f0
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x74], vtable.CParseConfig.0
mov byte [esp + 0x7ac], 7
mov ecx, dword [esp + 0x98]
mov esi, 0x10
cmp dword [esp + 0xac], esi
jae 0x4066ff
lea ecx, [esp + 0x98]
lea eax, [esp + 0x28]
push eax
call fcn.00401a10
test al, al
je 0x4074ce
cmp dword [esp + 0xc8], esi
mov ecx, dword [esp + 0xb4]
jae 0x406728
lea ecx, [esp + 0xb4]
call fcn.00402fd0
test eax, eax
je 0x40677d
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0xd4]
mov dword [ecx + 0x18], ebp
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00402280
sub esp, 0x1c
mov byte [esp + 0x7e4], 8
mov ecx, esp
mov dword [esp + 0x50], esp
push str.KillExe___fail
call fcn.004020b0
mov byte [esp + 0x7e4], 7
call fcn.004041e0
jmp 0x406788
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov byte [esp + 0x7ac], 9
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
cmp esi, eax
jbe 0x4067b1
call fcn.00432c1e
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0x28]
mov edi, ecx
mov dword [esp + 0x64], edi
mov ebp, esi
lea ecx, [ecx]
cmp dword [esp + 0x2c], eax
mov esi, eax
jbe 0x4067cd
call fcn.00432c1e
cmp edi, ebx
je 0x4067d9
lea eax, [esp + 0x28]
cmp edi, eax
je 0x4067de
call fcn.00432c1e
cmp ebp, esi
je 0x406a81
push 0x103
lea ecx, [esp + 0x141]
push ebx
push ecx
mov byte [esp + 0x148], bl
call fcn.00436440
add esp, 0xc
push 0x104
lea edx, [esp + 0x244]
push ebx
push edx
call fcn.00436440
add esp, 0xc
cmp edi, ebx
jne 0x406822
call fcn.00432c1e
cmp ebp, dword [edi + 8]
jb 0x40682c
call fcn.00432c1e
push ebp
lea edx, [esp + 0x488]
lea esi, [esp + 0x140]
call fcn.004034c0
test eax, eax
je 0x406b60
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
je 0x406b60
cmp ebp, dword [edi + 8]
jb 0x406863
call fcn.00432c1e
push ebp
lea ecx, [esp + 0x140]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edx, [esp + 0x344]
push edx
lea eax, [esp + 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4069a3
push ebx
call fcn.00433fb9
add esp, 4
lea ecx, [esp + 0x6c]
push ecx
mov ecx, str.._Y_m_d_H_M_S
lea edi, [esp + 0x20]
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edx
call fcn.00402e40
mov byte [esp + 0x7ac], 0xa
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x7c]
call fcn.004020b0
mov byte [esp + 0x7ac], 0xc
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4068f1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, 0x104
lea eax, [esp + 0x240]
lea ecx, [ecx]
mov cl, byte [eax - 0x104]
cmp cl, bl
je 0x406916
mov byte [eax], cl
add eax, 1
sub edx, 1
jne 0x406900
jmp 0x40691a
cmp edx, ebx
jne 0x40691d
sub eax, 1
cmp dword [esp + 0x90], 0x10
mov byte [eax], bl
mov eax, dword [esp + 0x7c]
jae 0x406931
lea eax, [esp + 0x7c]
push eax
lea edi, [esp + 0x244]
call fcn.00402f30
mov ecx, edi
push ecx
lea edx, [esp + 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x406ada
lea eax, [esp + 0x13c]
lea esi, [esp + 0x54]
call fcn.00410c70
mov eax, dword [esp + 0x64]
cmp ebp, dword [eax + 8]
jb 0x406975
call fcn.00432c1e
mov ecx, dword [ebp + 0x104]
push ecx
lea ecx, [esp + 0x140]
call fcn.00403670
test eax, eax
je 0x406a27
lea ecx, [esp + 0x78]
mov byte [esp + 0x7ac], 9
call fcn.00402120
jmp 0x406a06
sub esp, 0x1c
lea edx, [esp + 0x158]
mov ecx, esp
mov dword [esp + 0x34], esp
push edx
call fcn.004020b0
sub esp, 0x1c
mov byte [esp + 0x7e4], 0xf
mov ecx, esp
mov dword [esp + 0x58], esp
push 0x452a84
call fcn.004020b0
mov byte [esp + 0x7e4], 9
call fcn.004041e0
cmp ebp, dword [edi + 8]
jb 0x4069eb
call fcn.00432c1e
mov eax, dword [ebp + 0x104]
push eax
lea ecx, [esp + 0x140]
call fcn.00403670
test eax, eax
je 0x406b12
mov ecx, dword [esp + 0x64]
cmp ebp, dword [ecx + 8]
jb 0x406a14
call fcn.00432c1e
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x64]
add ebp, 0x214
jmp 0x4067c0
lea edx, [esp + 0x54]
push edx
call fcn.00403840
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x452a44
call fcn.004020b0
sub esp, 0x1c
mov byte [esp + 0x7e4], 0xd
mov ecx, esp
mov dword [esp + 0x50], esp
push 0x452a54
call fcn.004020b0
mov byte [esp + 0x7e4], 0xc
call fcn.004041e0
lea ecx, [esp + 0x78]
mov dword [esp + 0x14], ebx
mov byte [esp + 0x7ac], 9
call fcn.00402120
mov edi, 0xf
push 0x103
lea eax, [esp + 0x699]
push ebx
push eax
mov byte [esp + 0x6a0], bl
call fcn.00436440
lea eax, [esp + 0x6a0]
lea edx, [esp + 0x490]
mov ecx, eax
add esp, 0xc
mov esi, 0x104
sub edx, ecx
lea ebx, [ebx]
mov cl, byte [eax + edx]
cmp cl, bl
je 0x406bc9
mov byte [eax], cl
add eax, 1
sub esi, 1
jne 0x406ac0
jmp 0x406bcd
lea eax, [esp + 0x54]
push eax
call fcn.00403840
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x452b3c
call fcn.004020b0
sub esp, 0x1c
mov byte [esp + 0x7e4], 0xe
mov ecx, esp
mov dword [esp + 0x50], esp
push str.return_FALSE
jmp 0x406a5a
lea ecx, [esp + 0x54]
push ecx
call fcn.00403840
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x452a44
call fcn.004020b0
sub esp, 0x1c
mov byte [esp + 0x7e4], 0x10
mov ecx, esp
mov dword [esp + 0x50], esp
push 0x452a54
call fcn.004020b0
mov byte [esp + 0x7e4], 9
call fcn.004041e0
mov dword [esp + 0x14], ebx
jmp 0x406a81
lea edx, [esp + 0x54]
push edx
call fcn.00403840
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 5
mov edi, 0xf
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.fail_
mov byte [ecx + 4], bl
call fcn.004024f0
sub esp, 0x1c
mov byte [esp + 0x7e4], 0x11
mov ecx, esp
mov dword [esp + 0x50], esp
push 0x24
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push str.BuildPath
mov byte [ecx + 4], bl
call fcn.004024f0
mov byte [esp + 0x7e4], 9
call fcn.004041e0
mov dword [esp + 0x14], ebx
jmp 0x406a86
cmp esi, ebx
jne 0x406bd0
sub eax, 1
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
push str.update
lea edx, [esp + 0x698]
push edx
mov byte [eax], bl
call esi
push str.siteupdater.cfg
lea eax, [esp + 0x698]
push eax
call esi
lea eax, [esp + 0x694]
mov dword [esp + 0xe4], edi
mov dword [esp + 0xe0], ebx
mov byte [esp + 0xd0], bl
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x406c15
sub eax, esi
push eax
lea ecx, [esp + 0x698]
push ecx
lea ecx, [esp + 0xd4]
call fcn.004024f0
mov dword [esp + 0x138], edi
mov dword [esp + 0x134], ebx
mov byte [esp + 0x124], bl
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x11c], edi
mov dword [esp + 0x118], ebx
mov byte [esp + 0x108], bl
cmp dword [esp + 0x14], ebx
mov byte [esp + 0x7ac], 0x14
mov ebp, dword [sym.imp.ole32.dll_CoInitialize]
je 0x406f16
cmp dword [esp + 0xfc], ebx
je 0x406f16
push ebx
mov dword [esp + fcn.004156e0], vtable.cfg::CXML.0
mov dword [esp + 0x268], edi
mov dword [esp + 0x264], ebx
mov byte [esp + 0x254], bl
mov dword [esp + 0x26c], ebx
call ebp
mov dword [esp + fcn.004156e0], vtable.cfg::CXmlSvrUpdate.0
mov dword [esp + 0x140], 1
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0xd4]
push edx
lea ecx, [esp + 0x258]
mov byte [esp + 0x7b8], 0x15
call fcn.00402280
push 8
push 0x4526bc
lea eax, [esp + 0x14c]
push 0x104
push eax
call fcn.00432a79
add esp, 0x10
lea ecx, [esp + 0x13c]
mov dword [esp + 0x248], 8
call fcn.00414d40
test eax, eax
je 0x406ef6
push 7
push str.Version
lea ecx, [esp + 0x40]
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
call fcn.004024f0
mov byte [esp + 0x7ac], 0x16
push 7
push str.Product
lea ecx, [esp + 0x80]
mov dword [esp + 0x98], edi
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
call fcn.004024f0
push 3
lea ecx, [esp + 0x108]
push ecx
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x14c]
mov byte [esp + 0x7bc], 0x17
call fcn.004161a0
mov esi, 0x10
cmp dword [esp + 0x90], esi
jb 0x406db4
mov ecx, dword [esp + 0x7c]
push ecx
call fcn.00416c01
add esp, 4
mov byte [esp + 0x7ac], 0x15
cmp dword [esp + 0x50], esi
mov dword [esp + 0x90], edi
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
jb 0x406de1
mov edx, dword [esp + 0x3c]
push edx
call fcn.00416c01
add esp, 4
push 7
push str.Version
lea ecx, [esp + 0x40]
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
call fcn.004024f0
mov byte [esp + 0x7ac], 0x18
push 7
push str.Product
lea ecx, [esp + 0x80]
mov dword [esp + 0x98], edi
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
call fcn.004024f0
push 3
lea eax, [esp + 0xec]
push eax
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x84]
push edx
lea ecx, [esp + 0x14c]
mov byte [esp + 0x7bc], 0x19
call fcn.004153f0
cmp dword [esp + 0x90], 0x10
mov esi, eax
jb 0x406e71
mov eax, dword [esp + 0x7c]
push eax
call fcn.00416c01
add esp, 4
mov byte [esp + 0x7ac], 0x15
cmp dword [esp + 0x50], 0x10
mov dword [esp + 0x90], edi
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
jb 0x406e9f
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00416c01
add esp, 4
cmp esi, ebx
je 0x406ead
mov dword [esp + 0x1c], 1
jmp 0x406ef6
lea edx, [esp + 0x54]
push edx
call fcn.00403840
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x4529fc
mov dword [esp + 0x34], ebx
call fcn.004020b0
sub esp, 0x1c
mov byte [esp + 0x7e4], 0x1a
mov ecx, esp
mov dword [esp + 0x50], esp
push 0x452b74
call fcn.004020b0
mov byte [esp + 0x7e4], 0x15
call fcn.004041e0
lea eax, [esp + 0x13c]
mov byte [esp + 0x7ac], 0x14
push eax
mov dword [esp + fcn.004156e0], vtable.cfg::CXmlSvrUpdate.0
call fcn.00414c80
push 0x103
lea ecx, [esp + 0x591]
push ebx
push ecx
mov byte [esp + 0x598], bl
call fcn.00436440
lea eax, [esp + 0x598]
lea edx, [esp + 0x490]
mov ecx, eax
add esp, 0xc
mov esi, 0x104
sub edx, ecx
lea ebx, [ebx]
mov cl, byte [edx + eax]
cmp cl, bl
je 0x406f63
mov byte [eax], cl
add eax, 1
sub esi, 1
jne 0x406f50
jmp 0x406f67
cmp esi, ebx
jne 0x406f6a
sub eax, 1
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
push str.update
lea edx, [esp + 0x590]
push edx
mov byte [eax], bl
call esi
cmp dword [esp + 0xc8], 0x10
mov eax, dword [esp + 0xb4]
jae 0x406f99
lea eax, [esp + 0xb4]
push eax
lea eax, [esp + 0x590]
push eax
call esi
cmp dword [esp + 0x14], ebx
je 0x4071db
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 1
push ebx
push ebx
lea ecx, [esp + 0x598]
push ecx
push str.open
push ebx
call esi
cmp eax, 0x20
jl 0x406fde
je 0x406fde
lea edx, [esp + 0x54]
push edx
call fcn.00403db0
jmp 0x40736b
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 6
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x452b80
mov byte [ecx + 4], bl
call fcn.004024f0
sub esp, 0x1c
mov byte [esp + 0x7e4], 0x1b
mov ecx, esp
mov dword [esp + 0x50], esp
push 0x13
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push 0x452b88
mov byte [ecx + 4], bl
call fcn.004024f0
mov byte [esp + 0x7e4], 0x14
call fcn.004041e0
cmp dword [esp + 0x1c], ebx
je 0x4071b3
push ebx
mov dword [esp + fcn.004156e0], vtable.cfg::CXML.0
mov dword [esp + 0x268], edi
mov dword [esp + 0x264], ebx
mov byte [esp + 0x254], bl
mov dword [esp + 0x26c], ebx
call ebp
mov dword [esp + fcn.004156e0], vtable.cfg::CXmlSvrUpdate.0
mov dword [esp + 0x140], 1
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xd4]
push eax
lea ecx, [esp + 0x258]
mov byte [esp + 0x7b8], 0x1c
call fcn.00402280
push 8
push 0x4526bc
lea ecx, [esp + 0x14c]
push 0x104
push ecx
call fcn.00432a79
add esp, 0x10
lea ecx, [esp + 0x13c]
mov dword [esp + 0x248], 8
call fcn.00414d40
test eax, eax
je 0x40718c
push 7
push str.Version
lea ecx, [esp + 0x40]
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
call fcn.004024f0
mov byte [esp + 0x7ac], 0x1d
push 7
push str.Product
lea ecx, [esp + 0x80]
mov dword [esp + 0x98], edi
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
call fcn.004024f0
push 3
lea edx, [esp + 0x108]
push edx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x84]
push ecx
lea ecx, [esp + 0x14c]
mov byte [esp + 0x7bc], 0x1e
call fcn.004153f0
mov ebp, 0x10
cmp dword [esp + 0x90], ebp
jb 0x407165
mov edx, dword [esp + 0x7c]
push edx
call fcn.00416c01
add esp, 4
cmp dword [esp + 0x50], ebp
mov dword [esp + 0x90], edi
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
jb 0x407191
mov eax, dword [esp + 0x3c]
push eax
call fcn.00416c01
add esp, 4
jmp 0x407191
mov ebp, 0x10
lea ecx, [esp + 0x13c]
mov byte [esp + 0x7ac], 0x14
push ecx
mov dword [esp + fcn.004156e0], vtable.cfg::CXmlSvrUpdate.0
call fcn.00414c80
jmp 0x4071b8
mov ebp, 0x10
lea edx, [esp + 0x54]
push edx
call fcn.00403840
push 1
push ebx
push ebx
lea eax, [esp + 0x598]
push eax
push str.open
push ebx
call esi
jmp 0x407370
cmp dword [esp + 0x1c], ebx
je 0x407353
push ebx
mov dword [esp + fcn.004156e0], vtable.cfg::CXML.0
mov dword [esp + 0x268], edi
mov dword [esp + 0x264], ebx
mov byte [esp + 0x254], bl
mov dword [esp + 0x26c], ebx
call ebp
mov ebp, vtable.cfg::CXmlSvrUpdate.0
mov dword [esp + 0x13c], ebp
mov dword [esp + 0x140], 1
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0xd4]
push ecx
lea ecx, [esp + 0x258]
mov byte [esp + 0x7b8], 0x1f
call fcn.00402280
push 8
push 0x4526bc
lea edx, [esp + 0x14c]
push 0x104
push edx
call fcn.00432a79
add esp, 0x10
lea ecx, [esp + 0x13c]
mov dword [esp + 0x248], 8
call fcn.00414d40
test eax, eax
je 0x407337
push 7
push str.Version
lea ecx, [esp + 0x40]
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
call fcn.004024f0
mov byte [esp + 0x7ac], 0x20
push 7
push str.Product
lea ecx, [esp + 0x80]
mov dword [esp + 0x98], edi
mov dword [esp + 0x94], ebx
mov byte [esp + 0x84], bl
call fcn.004024f0
push 3
lea eax, [esp + 0x108]
push eax
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x84]
push edx
lea ecx, [esp + 0x14c]
mov byte [esp + 0x7bc], 0x21
call fcn.004153f0
mov esi, 0x10
cmp dword [esp + 0x90], esi
jb 0x407312
mov eax, dword [esp + 0x7c]
push eax
call fcn.00416c01
add esp, 4
cmp dword [esp + 0x50], esi
mov dword [esp + 0x90], edi
mov dword [esp + 0x8c], ebx
mov byte [esp + 0x7c], bl
jb 0x407337
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.00416c01
add esp, 4
lea edx, [esp + 0x13c]
mov byte [esp + 0x7ac], 0x14
push edx
mov dword [esp + 0x140], ebp
call fcn.00414c80
push 1
push ebx
push ebx
lea eax, [esp + 0x598]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ebp, 0x10
cmp dword [esp + 0x11c], ebp
jb 0x407389
mov ecx, dword [esp + 0x108]
push ecx
call fcn.00416c01
add esp, 4
cmp dword [esp + 0x138], ebp
mov dword [esp + 0x11c], edi
mov dword [esp + 0x118], ebx
mov byte [esp + 0x108], bl
jb 0x4073b7
mov edx, dword [esp + 0x124]
push edx
call fcn.00416c01
add esp, 4
cmp dword [esp + 0xe4], ebp
mov dword [esp + 0x138], edi
mov dword [esp + 0x134], ebx
mov byte [esp + 0x124], bl
jb 0x4073e5
mov eax, dword [esp + 0xd0]
push eax
call fcn.00416c01
add esp, 4
mov eax, dword [esp + 0x58]
cmp eax, ebx
mov dword [esp + 0xe4], edi
mov dword [esp + 0xe0], ebx
mov byte [esp + 0xd0], bl
je 0x40740b
push eax
call fcn.00416c01
add esp, 4
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x40741c
push eax
call fcn.00416c01
add esp, 4
cmp dword [esp + 0xc8], ebp
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
jb 0x407441
mov ecx, dword [esp + 0xb4]
push ecx
call fcn.00416c01
add esp, 4
mov byte [esp + 0x7ac], 1
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov dword [esp + 0xc8], edi
mov dword [esp + 0xc4], ebx
mov byte [esp + 0xb4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40747e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0xac], ebp
jb 0x407497
mov ecx, dword [esp + 0x98]
push ecx
call fcn.00416c01
add esp, 4
cmp dword [esp + 0x100], ebp
mov dword [esp + 0xac], edi
mov dword [esp + 0xa8], ebx
mov byte [esp + 0x98], bl
jb 0x4074c5
mov edx, dword [esp + 0xec]
push edx
call fcn.00416c01
add esp, 4
mov eax, dword [esp + 0x14]
jmp 0x4075c5
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push 0x452ae4
call fcn.004020b0
sub esp, 0x1c
mov byte [esp + 0x7e4], 0x22
mov ecx, esp
mov dword [esp + 0x50], esp
push 0x452af8
call fcn.004020b0
mov byte [esp + 0x7e4], 7
call fcn.004041e0
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x40751a
push eax
call fcn.00416c01
add esp, 4
cmp dword [esp + 0xc8], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
jb 0x40753f
mov eax, dword [esp + 0xb4]
push eax
call fcn.00416c01
add esp, 4
mov byte [esp + 0x7ac], 1
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov dword [esp + 0xc8], ebp
mov dword [esp + 0xc4], ebx
mov byte [esp + 0xb4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40757c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [esp + 0xac], esi
jb 0x407595
mov ecx, dword [esp + 0x98]
push ecx
call fcn.00416c01
add esp, 4
cmp dword [esp + 0x100], esi
mov byte [esp + 0x98], bl
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebp
jb 0x4075c3
mov edx, dword [esp + 0xec]
push edx
call fcn.00416c01
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x7a4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x788]
xor ecx, esp
call fcn.004322f2
add esp, 0x79c
ret 4