Function at 0x419ec8
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528139
mov eax, dword fs:[0]
push eax
mov eax, 0x21a0
call fcn.004e2d90
mov eax, dword [0x578704]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x108]
cmp ecx, dword [esi + 0x35c]
je 0x41a528
cmp ecx, dword [esi + 0x358]
jne 0x419f31
push 0
push 0xf020
push 0x112
mov ecx, esi
call fcn.0044f053
jmp 0x41aa6d
mov eax, dword [ecx]
lea edx, [ebp - 0x20dc]
push edx
call dword [eax + 4]
and dword [ebp - 4], 0
mov ecx, eax
push str.install_minbtn
call fcn.0044dfdb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20dc]
mov bl, al
call fcn.0044df15
test bl, bl
jne 0x419f19
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20dc]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.install_closebtn
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.0044dfdb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20dc]
mov bl, al
call fcn.0044df15
test bl, bl
jne 0x41a528
mov ecx, dword [edi + 0x108]
cmp ecx, dword [esi + 0x360]
jne 0x419fb9
mov ecx, dword [esi + 0x368]
jmp 0x41aa46
mov eax, dword [ecx]
lea edx, [ebp - 0x20dc]
push edx
call dword [eax + 4]
push str.step_last
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.0044dfdb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20dc]
mov bl, al
call fcn.0044df15
test bl, bl
je 0x41a001
mov ecx, esi
call fcn.0041f947
mov ecx, dword [esi + 0x368]
push 0
jmp 0x41aa48
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20dc]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.install_btn
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.0044dfdb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20dc]
mov bl, al
call fcn.0044df15
test bl, bl
je 0x41a460
push ecx
push ecx
push str.void___thiscall_InstallUIMainWnd::OnClick_struct_DuiLib::tagTNotifyUI__
push 0x1d8
push str........._srcCommoninstall_ui_mainwnd.cpp
push 0x80
lea ecx, [ebp - 0x21ac]
call fcn.004064f1
push str.default
push 1
push eax
mov dword [ebp - 4], 4
call fcn.00406584
add esp, 0xc
cmp byte [eax + 0x1c], 0
je 0x41a08a
push str._Click_install_button
lea ecx, [eax + 0x20]
call fcn.00406419
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x21ac]
mov dword [ebp - method.el::base::Writer.virtual_0], vtable.el::base::Writer.0
call fcn.004067e3
lea ecx, [ebp - 0x2180]
call fcn.00409846
or dword [ebp - 4], 0xffffffff
mov edi, str.Download
push 0
push 0x560194
push str.2.DownStart
push edi
call fcn.0043200e
mov ecx, eax
call fcn.0043206a
sub esp, 0x18
mov ebx, 0x55ae38
mov ecx, esp
mov dword [ebp - 0x2168], esp
push ebx
call fcn.00409c4d
sub esp, 0x18
mov dword [ebp - 4], 6
mov ecx, esp
mov dword [ebp - 0x216c], esp
push str.CoreFuncStart
call fcn.00409c4d
sub esp, 0x18
mov byte [ebp - 4], 7
mov ecx, esp
mov dword [ebp - 0x2170], esp
push edi
call fcn.00409c4d
sub esp, 0x18
mov byte [ebp - 4], 8
mov ecx, esp
mov dword [ebp - 0x2174], esp
push str.Downloading
call fcn.00409c4d
sub esp, 0x18
mov byte [ebp - 4], 9
mov ecx, esp
mov dword [ebp - 0x2164], esp
push str.CoreFuncEvent
call fcn.00409c4d
mov byte [ebp - 4], 0xa
call fcn.0043200e
or dword [ebp - 4], 0xffffffff
xor eax, eax
push eax
push eax
push eax
call fcn.00433c36
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2164], esp
push ebx
call fcn.00409c4d
sub esp, 0x18
mov dword [ebp - 4], 0xb
mov ecx, esp
mov dword [ebp - 0x2174], esp
push str.DownStart
call fcn.00409c4d
sub esp, 0x18
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ebp - 0x2170], esp
push edi
call fcn.00409c4d
mov byte [ebp - 4], 0xd
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x216c], esp
push str.Downloading
call fcn.00409c4d
sub esp, 0x18
mov byte [ebp - 4], 0xe
mov ecx, esp
mov dword [ebp - 0x2168], esp
push str.CoreFuncEvent
call fcn.00409c4d
mov byte [ebp - 4], 0xf
call fcn.0043200e
or dword [ebp - 4], 0xffffffff
xor ebx, ebx
push ebx
push ebx
push 1
call fcn.00433c36
cmp byte [0x57f060], bl
jne 0x41a2c9
lea ecx, [ebp - 0x2028]
call fcn.0042f615
push 0xa
push ebx
lea ecx, [ebp - 0x2040]
mov dword [ebp - 4], 0x10
push ecx
mov ecx, eax
call fcn.00409a0f
mov byte [ebp - 4], 0x11
cmp dword [eax + 0x14], 0x10
jb 0x41a22a
mov eax, dword [eax]
push ebx
push eax
push str.StartTimeDate
push edi
call fcn.0043200e
mov ecx, eax
call fcn.0043206a
push ebx
push 1
lea ecx, [ebp - 0x2040]
call fcn.0040c02b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2028]
push ebx
push 1
call fcn.0040c02b
lea ecx, [ebp - 0x2028]
call fcn.0042f615
push 2
push 0xb
lea ecx, [ebp - 0x2040]
mov dword [ebp - 4], 0x12
push ecx
mov ecx, eax
call fcn.00409a0f
mov byte [ebp - 4], 0x13
cmp dword [eax + 0x14], 0x10
jb 0x41a28e
mov eax, dword [eax]
push ebx
push eax
push str.StartTimeHour
push edi
call fcn.0043200e
mov ecx, eax
call fcn.0043206a
push ebx
push 1
lea ecx, [ebp - 0x2040]
call fcn.0040c02b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2028]
push ebx
push 1
call fcn.0040c02b
mov byte [0x57f060], 1
mov ecx, dword [esi + 0x470]
call fcn.00452dca
push 0x560194
lea ecx, [ebp - 0x2028]
call fcn.00409c4d
mov dword [ebp - 4], 0x14
mov eax, dword [esi + 0x4d0]
cmp eax, 0x13
ja case.0x41a2fa.0
jmp dword [eax*4 + 0x41aa8c]
mov edi, str.Japanese
jmp 0x41a38e
mov edi, 0x55aeac
jmp 0x41a38e
mov edi, str.Spanish
jmp 0x41a38e
mov edi, str.German
jmp 0x41a38e
mov edi, str.French
jmp 0x41a38e
mov edi, str.Russian
jmp 0x41a38e
mov edi, str.Portuguese
jmp 0x41a38e
mov edi, str.Arabic
jmp 0x41a38e
mov edi, str.Italiano
jmp 0x41a38e
mov edi, str.ChineseTrad
jmp 0x41a38e
mov edi, str.Korean
jmp 0x41a38e
mov edi, str.Nederlands
jmp 0x41a38e
mov edi, str.Indonesian
jmp 0x41a38e
mov edi, str.Turkish
jmp 0x41a38e
mov edi, str.Hindi
jmp 0x41a38e
mov edi, str.Thai
jmp 0x41a38e
mov edi, str.Malay
jmp 0x41a38e
mov edi, str.Swedish
jmp 0x41a38e
mov edi, str.Czech
jmp 0x41a38e
mov edi, 0x55ae98
push edi
call fcn.00402ce5
pop ecx
push eax
push edi
lea ecx, [ebp - 0x2028]
call fcn.0040c552
cmp dword [ebp - 0x2014], 0x10
lea eax, [ebp - 0x2028]
push ebx
cmovae eax, dword [ebp - 0x2028]
mov edi, str.Other
push eax
push str.SetLanguage
push edi
call fcn.0043200e
mov ecx, eax
call fcn.0043206a
mov ecx, dword [esi + 0x36c]
lea edx, [ebp - 0x20dc]
push edx
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, eax
mov byte [ebp - 4], 0x15
call fcn.0044e46d
push eax
lea ecx, [ebp - 0x2040]
call fcn.004099b0
lea ecx, [ebp - 0x20dc]
mov byte [ebp - 4], 0x17
call fcn.0044df15
lea edx, [esi + 0x528]
lea ecx, [ebp - 0x2040]
call fcn.004279aa
test al, al
jne 0x41a434
push ebx
push 0x560194
push str.SetPath
push edi
call fcn.0043200e
mov ecx, eax
call fcn.0043206a
push ebx
push 1
lea ecx, [ebp - 0x2040]
call fcn.00402226
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2028]
push ebx
push 1
call fcn.0040c02b
mov ecx, esi
call fcn.00420613
jmp 0x41aa6d
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20dc]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.finish_btn
mov ecx, eax
mov dword [ebp - 4], 0x18
call fcn.0044dfdb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20dc]
mov bl, al
call fcn.0044df15
test bl, bl
je 0x41a4a8
push 0
mov ecx, esi
call fcn.0044ec77
jmp 0x41aa6d
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20dc]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.browser_btn
mov ecx, eax
mov dword [ebp - 4], 0x19
call fcn.0044dfdb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20dc]
mov bl, al
call fcn.0044df15
test bl, bl
je 0x41a4ee
mov ecx, esi
call fcn.0041ac97
jmp 0x41aa6d
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x20dc]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.cancel_btn
mov ecx, eax
mov dword [ebp - 4], 0x1a
call fcn.0044dfdb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20dc]
mov bl, al
call fcn.0044df15
test bl, bl
je 0x41a534
mov ecx, esi
call fcn.00420935
jmp 0x41aa6d
mov ecx, dword [edi + 0x108]
mov eax, dword [esi + 0x46c]
cmp ecx, eax
jne 0x41a568
mov ecx, eax
call fcn.00452dca
mov ecx, dword [esi + 0x47c]
test al, al
mov eax, dword [ecx]
je 0x41a55b
push 0
jmp 0x41a55d
push 1
call dword [eax + 0xd8]
jmp 0x41aa6d
mov eax, dword [ecx]
lea edx, [ebp - 0x20dc]
push edx
call dword [eax + 4]
push str.start_app
mov ecx, eax
mov dword [ebp - 4], 0x1b
call fcn.0044dfdb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20dc]
mov bl, al
call fcn.0044df15
test bl, bl
je 0x41a9d1
mov ecx, dword [esi + 0x494]
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x41a72b
mov ecx, dword [esi + 0x498]
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x41a72b
mov ecx, dword [esi + 0x4a0]
mov eax, dword [ecx]
call dword [eax + 0xc8]
test al, al
je 0x41a72b
push ecx
push ecx
push str.void___thiscall_InstallUIMainWnd::OnClick_struct_DuiLib::tagTNotifyUI__
push 0x24e
push str........._srcCommoninstall_ui_mainwnd.cpp
push 0x80
lea ecx, [ebp - 0x21ac]
call fcn.004064f1
push str.default
push 1
push eax
mov dword [ebp - 4], 0x1c
call fcn.00406584
add esp, 0xc
cmp byte [eax + 0x1c], 0
je 0x41a62d
push str._User_click_try_again_button_to_retry
lea ecx, [eax + 0x20]
call fcn.00406419
mov dword [ebp - 4], 0x1d
lea ecx, [ebp - 0x21ac]
mov dword [ebp - method.el::base::Writer.virtual_0], vtable.el::base::Writer.0
call fcn.004067e3
lea ecx, [ebp - 0x2180]
call fcn.00409846
or dword [ebp - 4], 0xffffffff
xor ebx, ebx
cmp byte [esi + 0x58c], bl
mov ecx, str.First
push ebx
mov eax, str.Retry
mov edi, str.Download
cmove eax, ecx
push eax
push str.8_1.ClickTryAgain
push edi
call fcn.0043200e
mov ecx, eax
call fcn.0043206a
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2164], esp
push 0x55ae38
call fcn.00409c4d
sub esp, 0x18
mov dword [ebp - 4], 0x1e
mov ecx, esp
mov dword [ebp - 0x2174], esp
push str.CoreFuncStart
call fcn.00409c4d
sub esp, 0x18
mov byte [ebp - 4], 0x1f
mov ecx, esp
mov dword [ebp - 0x2170], esp
push edi
call fcn.00409c4d
sub esp, 0x18
mov byte [ebp - 4], 0x20
mov ecx, esp
mov dword [ebp - 0x216c], esp
push str.Downloading
call fcn.00409c4d
sub esp, 0x18
mov byte [ebp - 4], 0x21
mov ecx, esp
mov dword [ebp - 0x2168], esp
push str.CoreFuncEvent
call fcn.00409c4d
mov byte [ebp - 4], 0x22
call fcn.0043200e
or dword [ebp - 4], 0xffffffff
push ebx
push ebx
push ebx
call fcn.00433c36
mov ecx, dword [esi + 0x370]
push ebx
mov byte [esi + 0x58c], 1
call fcn.00454ba4
jmp 0x41a454
push 0x554928
lea ecx, [ebp - 0x2040]
call fcn.004099b0
lea eax, [ebp - 0x2040]
mov dword [ebp - 4], 0x23
push eax
mov ecx, esi
call fcn.0041addc
mov eax, dword [esi + 0x560]
sub esp, 0x18
add eax, 0xe8
mov ecx, esp
push eax
call fcn.004021fe
call fcn.0042f45a
add esp, 0x18
test al, al
je 0x41a8e6
sub esp, 0x18
lea eax, [ebp - 0x2040]
mov ecx, esp
push eax
call fcn.004021fe
call fcn.0042f2f8
add esp, 0x18
test al, al
je 0x41a79a
and dword [esi + 0x584], 0
cmp dword [esi + 0x584], 0
mov edi, str.Download
sete al
movzx eax, al
push eax
push 0x560194
push str.7.ProgramLaunch
push edi
call fcn.0043200e
mov ecx, eax
call fcn.0043206a
sub esp, 0x18
mov ebx, 0x55ae38
mov ecx, esp
mov dword [ebp - 0x2164], esp
push ebx
call fcn.00409c4d
sub esp, 0x18
mov byte [ebp - 4], 0x24
mov ecx, esp
mov dword [ebp - 0x2174], esp
push str.CoreFuncStart
call fcn.00409c4d
sub esp, 0x18
mov byte [ebp - 4], 0x25
mov ecx, esp
mov dword [ebp - 0x2170], esp
push edi
call fcn.00409c4d
sub esp, 0x18
mov byte [ebp - 4], 0x26
mov ecx, esp
mov dword [ebp - 0x216c], esp
push str.Starting
call fcn.00409c4d
sub esp, 0x18
mov byte [ebp - 4], 0x27
mov ecx, esp
mov dword [ebp - 0x2168], esp
push str.CoreFuncEvent
call fcn.00409c4d
mov byte [ebp - 4], 0x28
call fcn.0043200e
xor eax, eax
mov byte [ebp - 4], 0x23
push eax
push eax
push eax
call fcn.00433c36
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2164], esp
push ebx
call fcn.00409c4d
sub esp, 0x18
mov byte [ebp - 4], 0x29
mov ecx, esp
mov dword [ebp - 0x2174], esp
push str.ProgramLaunch
call fcn.00409c4d
sub esp, 0x18
mov byte [ebp - 4], 0x2a
mov ecx, esp
mov dword [ebp - 0x2170], esp
push edi
call fcn.00409c4d
sub esp, 0x18
mov byte [ebp - 4], 0x2b
mov ecx, esp
mov dword [ebp - 0x216c], esp
push str.Starting
call fcn.00409c4d
sub esp, 0x18
mov byte [ebp - 4], 0x2c
mov ecx, esp
mov dword [ebp - 0x2168], esp
push str.CoreFuncEvent
call fcn.00409c4d
mov byte [ebp - 4], 0x2d
call fcn.0043200e
xor ebx, ebx
mov byte [ebp - 4], 0x23
push ebx
push ebx
push 1
call fcn.00433c36
mov ecx, esi
call fcn.0041f4c2
jmp 0x41a9be
xor ebx, ebx
mov dword [ebp - 0x2014], 7
xor eax, eax
mov dword [ebp - 0x2018], ebx
mov word [ebp - 0x2028], ax
push 0x559cf0
lea eax, [esi + 0x540]
mov byte [ebp - 4], 0x2e
push eax
lea eax, [ebp - 0x2058]
push eax
call fcn.0042777e
add esp, 0xc
lea ecx, [ebp - 0x2028]
push eax
call fcn.004021ad
push ebx
push 1
lea ecx, [ebp - 0x2058]
call fcn.00402226
push 1
lea eax, [ebp - 0x2058]
mov ecx, esi
push eax
call fcn.0042363c
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2028]
mov byte [ebp - 4], 0x2f
call fcn.00426998
push ebx
push 1
lea ecx, [ebp - 0x2058]
call fcn.00402226
cmp dword [ebp - 0x2014], 8
lea eax, [ebp - 0x2028]
cmovae eax, dword [ebp - 0x2028]
push eax
lea eax, [ebp - 0x2010]
push str._select___s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x2010]
push 1
push ebx
push eax
push str.explorer.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebx
push 1
lea ecx, [ebp - 0x2028]
call fcn.00402226
push ebx
push 1
lea ecx, [ebp - 0x2040]
call fcn.00402226
jmp 0x41aa6d
mov ecx, dword [edi + 0x108]
lea edx, [ebp - 0x2160]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.install_setting
mov ecx, eax
mov dword [ebp - 4], 0x30
call fcn.0044dfdb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2160]
mov bl, al
call fcn.0044df15
test bl, bl
je 0x41aa6d
cmp byte [0x57f074], 0
mov ecx, dword [esi + 0x474]
je 0x41aa52
call fcn.00453575
cmp eax, 1
jne 0x41aa36
push eax
push ecx
mov ecx, esi
call fcn.0041f467
mov byte [0x57f074], 0
jmp 0x41aa6d
push 0
push ecx
mov ecx, esi
call fcn.0041f467
mov ecx, dword [esi + 0x474]
push 1
mov eax, dword [ecx]
call dword [eax + 0x1bc]
jmp 0x41aa6d
mov eax, dword [ecx]
push 1
call dword [eax + 0x1bc]
push 0
push ecx
mov ecx, esi
call fcn.0041f467
mov byte [0x57f074], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e1d28
mov esp, ebp
pop ebp
ret 4