Function at 0x4125f0
Capabilities:
Accept command line arguments
Extract resource via kernel32 functions
Get common file path
Hide graphical window
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x88
mov eax, dword [0x464024]
xor eax, esp
mov dword [esp + 0x84], eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
mov edi, dword [ebp + 8]
push 0
push 0x32
mov dword [0x46c794], edi
mov dword [esp + 0x64], 0x30
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0x40bad0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
mov dword [esp + 0x78], edi
call esi
push eax
push 0x31
call esi
push eax
push 1
push 0x5277
push edi
call dword [sym.imp.USER32.dll_LoadImageW]
push 0x7f00
mov esi, eax
push 0
mov dword [esp + 0x7c], esi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [esp + 0x78], eax
lea eax, [esp + 0x5c]
push eax
mov dword [esp + 0x80], 6
mov dword [esp + 0x84], 0
mov dword [esp + 0x88], 0x4690c8
mov dword [esp + 0x8c], esi
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
jne 0x4126dc
push 0x10
push str.Error_
push str.Error_Registering_Window_
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.0041ae8f
mov esp, ebp
pop ebp
ret 0x10
push 0x46b098
push 0x46b2b0
push str.Setup
push str._s__s__s
push 0x46a838
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0x11c
call fcn.0041b284
add esp, 4
mov esi, eax
push pe_nt_image_headers32
lea ecx, [esi + 4]
push 0
push ecx
call fcn.0041c7e0
add esp, 0xc
mov dword [esi], 0x11c
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4127ec
push esi
call eax
test eax, eax
jne 0x4127d8
mov ecx, dword [esi + 4]
cmp ecx, 0xa
jb 0x412764
mov dword [0x46c570], 4
jmp 0x412798
cmp ecx, 6
ja 0x41278e
jb 0x412782
mov eax, dword [esi + 8]
cmp eax, 2
jae 0x41278e
cmp eax, 1
sbb eax, eax
add eax, 2
mov dword [0x46c570], eax
jmp 0x412798
mov dword [0x46c570], 0
jmp 0x412798
mov dword [0x46c570], 3
push dword [esi + 8]
mov edx, str.OS_version:_Windows
push ecx
push ecx
mov ecx, 0x469798
call fcn.00416b70
add esp, 4
mov ecx, eax
call fcn.00413530
push ecx
mov edx, 0x45dc64
mov ecx, eax
call fcn.00416b70
add esp, 4
mov ecx, eax
call fcn.00413530
push eax
call fcn.00416e10
add esp, 4
jmp 0x4127de
push ecx
call fcn.00413890
push 0x11c
push esi
call fcn.0041b61a
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0x10]
call fcn.00414580
mov ecx, dword [esp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.004164d0
lea edi, [eax + 0x10]
mov dword [esp + 0x28], edi
call fcn.004024e0
mov ecx, eax
test ecx, ecx
je 0x413421
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
push 0x45e5e8
push dword [esp + 0x10]
lea esi, [eax + 0x10]
mov dword [esp + 0x24], esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
neg eax
sbb eax, eax
neg eax
cmp dword [0x46c570], 0
mov dword [0x46a830], eax
jle 0x412866
push str._DELTASK_
push dword [esp + 0x10]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x41342b
push 0x449958
push 0x46c368
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x100
push 0x5286
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push dword [esp + 0xc]
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push dword [esp + 0x14]
mov dword [esp + 0x24], eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [esp + 0x20]
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [esp + 0x20], eax
xor ecx, ecx
mov eax, dword [esp + 8]
mov edx, 2
lea eax, [eax*2 + 2]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041b628
add esp, 4
mov dword [esp + 0x14], eax
push dword [esp + 8]
push dword [esp + 0x24]
push eax
call fcn.0041c940
mov eax, dword [esp + 0x14]
add esp, 0xc
mov ecx, dword [esp + 0x14]
xor edx, edx
shr eax, 1
push 0x45e610
push ecx
mov word [ecx + eax*2], dx
lea ecx, [esp + 0x20]
call fcn.00414580
mov edx, eax
lea ecx, [esp + 0x28]
call fcn.00413da0
lea ecx, [esi - 0x10]
add esp, 4
mov dword [esp + 8], ecx
mov edx, dword [eax]
lea eax, [edx - 0x10]
mov dword [esp + 0x20], eax
cmp eax, ecx
je 0x412992
cmp dword [ecx + 0xc], 0
lea esi, [ecx + 0xc]
jl 0x412981
mov eax, dword [eax]
cmp eax, dword [ecx]
jne 0x412981
mov ecx, dword [esp + 0x20]
call fcn.004164d0
mov dword [esp + 0x20], eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x412978
mov esi, dword [esp + 8]
push esi
mov ecx, dword [esi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x20]
lea esi, [eax + 0x10]
mov dword [esp + 0x1c], esi
jmp 0x412992
push dword [edx - 0xc]
lea ecx, [esp + 0x20]
push edx
call fcn.00416540
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4129ae
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 0x18]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4129ca
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [0x46c5b4]
lea ecx, [esi - 0x10]
add edx, 0xfffffff0
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], edx
cmp ecx, edx
je 0x412a36
cmp dword [edx + 0xc], 0
lea eax, [edx + 0xc]
mov dword [esp + 0x18], eax
jl 0x412a28
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x412a28
call fcn.004164d0
mov edx, dword [esp + 0x18]
or ecx, 0xffffffff
mov dword [esp + 0x20], eax
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412a1e
mov esi, dword [esp + 0x24]
push esi
mov ecx, dword [esi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x20]
add eax, 0x10
mov dword [0x46c5b4], eax
jmp 0x412a36
push dword [esi - 0xc]
mov ecx, 0x46c5b4
push esi
call fcn.00416540
push dword [esp + 0x14]
call fcn.0041ae9d
add esp, 4
mov ecx, 0x46c73c
push 0
push 0x449958
call fcn.00416540
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x100
push 0x5285
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [esp + 0xc]
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [esp + 0x18]
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
xor ecx, ecx
mov eax, dword [esp + 8]
mov edx, 2
lea eax, [eax*2 + 2]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041b628
add esp, 4
mov dword [esp + 0x14], eax
push dword [esp + 8]
push esi
push eax
call fcn.0041c940
mov eax, dword [esp + 0x14]
add esp, 0xc
mov ecx, dword [esp + 0x14]
xor edx, edx
shr eax, 1
push 0x45e610
push ecx
mov word [ecx + eax*2], dx
mov edx, 0x46c73c
lea ecx, [esp + 0x28]
call fcn.00413da0
add esp, 4
lea ecx, [esp + 0x28]
mov edx, eax
call fcn.00413da0
mov esi, dword [0x46c73c]
add esp, 4
add esi, 0xfffffff0
mov edx, dword [eax]
lea ecx, [edx - 0x10]
cmp ecx, esi
je 0x412b61
cmp dword [esi + 0xc], 0
jl 0x412b53
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x412b53
call fcn.004164d0
mov dword [esp + 0x18], eax
lea edx, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412b49
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0x10
mov dword [0x46c73c], eax
jmp 0x412b61
push dword [edx - 0xc]
mov ecx, 0x46c73c
push edx
call fcn.00416540
mov edx, dword [esp + 0x24]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x412b7d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 0x20]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x412b99
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [esp + 0x14]
call fcn.0041ae9d
mov ecx, dword [0x46c73c]
mov esi, esp
add ecx, 0xfffffff0
call fcn.004164d0
add eax, 0x10
push ecx
mov dword [esi], eax
mov esi, esp
call fcn.004024e0
mov ecx, eax
test ecx, ecx
je 0x413421
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov ecx, esi
push str.AppName
mov dword [esi], eax
call fcn.004153b0
test al, al
jne 0x412bf3
push 7
push str.AppName
mov ecx, esi
call fcn.00416540
push ecx
mov esi, esp
call fcn.004024e0
mov ecx, eax
test ecx, ecx
je 0x413421
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov ecx, esi
push str._data_
mov dword [esi], eax
call fcn.004153b0
test al, al
jne 0x412c2f
push 6
push str._data_
mov ecx, esi
call fcn.00416540
lea ecx, [esp + 0x24]
call fcn.00403a60
mov esi, dword [esp + 0x1c]
add esp, 0xc
mov edx, dword [eax]
lea ecx, [edx - 0x10]
cmp ecx, esi
je 0x412c8e
cmp dword [esi + 0xc], 0
jl 0x412c81
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x412c81
call fcn.004164d0
mov dword [esp + 0x10], eax
lea edx, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412c78
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0x10
mov dword [esp + 0x1c], eax
jmp 0x412c8e
push dword [edx - 0xc]
lea ecx, [esp + 0x20]
push edx
call fcn.00416540
mov edx, dword [esp + 0x18]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x412caa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
push 0x45e618
lea ecx, [esp + 0x24]
call fcn.004140e0
mov esi, dword [esp + 0x1c]
cmp dword [esi - 4], 1
jle 0x412cd3
push dword [esi - 0xc]
lea ecx, [esp + 0x20]
call fcn.004154d0
mov esi, dword [esp + 0x1c]
push esi
push 0x46b2b0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x45e61c
push dword [esp + 0x10]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
push ecx
test eax, eax
jne 0x41343c
mov ecx, dword [0x46c73c]
mov dword [esp + 0x14], esp
lea ecx, [ecx - 0x10]
call fcn.004164d0
mov ecx, esp
add eax, 0x10
mov dword [ecx], eax
call fcn.00403d90
mov ecx, dword [0x46c73c]
mov dword [esp + 0x14], esp
lea ecx, [ecx - 0x10]
call fcn.004164d0
mov ecx, esp
add eax, 0x10
mov dword [ecx], eax
call fcn.004040c0
mov ecx, dword [0x46c73c]
mov dword [esp + 0x14], esp
lea ecx, [ecx - 0x10]
call fcn.004164d0
mov ecx, esp
add eax, 0x10
mov dword [ecx], eax
call fcn.00404450
mov ecx, dword [0x46c73c]
mov dword [esp + 0x14], esp
lea ecx, [ecx - 0x10]
call fcn.004164d0
mov ecx, esp
add eax, 0x10
mov dword [ecx], eax
call fcn.004047e0
add esp, 4
call fcn.0040abf0
push 0
push 0x449958
mov ecx, 0x46c748
call fcn.00416540
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
cmp ecx, 1
jle 0x412dc1
mov dword [0x46a5d0], 0
mov word [0x46a5d5], 0
mov byte [0x46a5d4], 0
mov dword [esp + 8], 0
test ecx, ecx
jle 0x413172
or edi, 0xffffffff
xor esi, esi
nop word [eax + eax]
push str.DIR
push dword [eax + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x412e8d
mov edx, dword [esp + 0x14]
mov edx, dword [edx + esi*4]
test edx, edx
jne 0x412e05
xor ecx, ecx
jmp 0x412e23
mov ecx, edx
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412e10
sub ecx, esi
mov esi, dword [esp + 8]
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x14]
call fcn.00416540
mov eax, dword [esp + 0xc]
cmp dword [eax - 0xc], 0
jl 0x412e6b
push 0x449ac0
push eax
call fcn.0041c1a5
mov ecx, eax
add esp, 8
mov eax, dword [esp + 0xc]
test ecx, ecx
je 0x412e6b
sub ecx, eax
sar ecx, 1
cmp ecx, 0xffffffff
jle 0x412e6b
lea eax, [ecx + 1]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.004142f0
mov eax, dword [esp + 0xc]
cmp dword [eax - 4], 1
jle 0x412e81
push dword [eax - 0xc]
lea ecx, [esp + 0x10]
call fcn.004154d0
mov eax, dword [esp + 0xc]
push eax
push 0x46c368
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esp + 0x14]
push 0x45f0bc
push dword [eax + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x412f3e
mov eax, dword [esp + 0x14]
mov edx, dword [eax + esi*4]
test edx, edx
jne 0x412eb6
xor ecx, ecx
jmp 0x412ed3
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412ec0
sub ecx, esi
mov esi, dword [esp + 8]
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x14]
call fcn.00416540
mov eax, dword [esp + 0xc]
cmp dword [eax - 0xc], 0
jge 0x412eed
or eax, 0xffffffff
jmp 0x412f0a
push 0x45f0bc
push eax
call fcn.0041c1a5
add esp, 8
test eax, eax
jne 0x412f04
or eax, 0xffffffff
jmp 0x412f0a
sub eax, dword [esp + 0xc]
sar eax, 1
add eax, 2
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.004142f0
mov eax, dword [esp + 0xc]
cmp dword [eax - 4], 1
jle 0x412f32
push dword [eax - 0xc]
lea ecx, [esp + 0x10]
call fcn.004154d0
mov eax, dword [esp + 0xc]
push eax
push 0x46c158
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esp + 0x14]
push 0x45f0c4
push dword [eax + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x413038
mov eax, dword [esp + 0x14]
mov edx, dword [eax + esi*4]
test edx, edx
jne 0x412f67
xor ecx, ecx
jmp 0x412f83
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412f70
sub ecx, esi
mov esi, dword [esp + 8]
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x14]
call fcn.00416540
mov eax, dword [esp + 0xc]
cmp dword [eax - 0xc], 0
jl 0x412fcb
push 0x449ac0
push eax
call fcn.0041c1a5
mov ecx, eax
add esp, 8
mov eax, dword [esp + 0xc]
test ecx, ecx
je 0x412fcb
sub ecx, eax
sar ecx, 1
cmp ecx, 0xffffffff
jle 0x412fcb
lea eax, [ecx + 1]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.004142f0
mov eax, dword [esp + 0xc]
mov ecx, dword [0x46c748]
lea edx, [eax - 0x10]
add ecx, 0xfffffff0
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], ecx
cmp edx, ecx
je 0x413038
cmp dword [ecx + 0xc], 0
lea esi, [ecx + 0xc]
mov dword [esp + 0x18], esi
jl 0x413026
mov edx, dword [edx]
cmp edx, dword [ecx]
jne 0x413026
mov ecx, dword [esp + 0x10]
call fcn.004164d0
mov esi, eax
mov ecx, edi
mov eax, dword [esp + 0x18]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41301c
mov eax, dword [esp + 0x24]
push eax
mov ecx, dword [eax]
mov edx, dword [ecx]
call dword [edx + 4]
lea eax, [esi + 0x10]
mov dword [0x46c748], eax
jmp 0x413034
push dword [eax - 0xc]
mov ecx, 0x46c748
push eax
call fcn.00416540
mov esi, dword [esp + 8]
mov eax, dword [esp + 0x14]
push 0x45f0cc
push dword [eax + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
movzx ecx, byte [0x46a5d0]
test eax, eax
mov eax, 1
cmovne ecx, eax
mov eax, dword [esp + 0x14]
push 0x45f0d4
mov byte [0x46a5d0], cl
push dword [eax + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
movzx ecx, byte [0x46a5d1]
test eax, eax
mov eax, 1
cmovne ecx, eax
mov eax, dword [esp + 0x14]
push 0x45f0dc
mov byte [0x46a5d1], cl
push dword [eax + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
movzx ecx, byte [0x46a5d2]
test eax, eax
mov eax, 1
cmovne ecx, eax
mov eax, dword [esp + 0x14]
push 0x45f0e4
mov byte [0x46a5d2], cl
push dword [eax + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
movzx ecx, byte [0x46a5d3]
test eax, eax
mov eax, 1
cmovne ecx, eax
mov eax, dword [esp + 0x14]
push 0x45f0ec
mov byte [0x46a5d3], cl
push dword [eax + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
movzx ecx, byte [0x46a5d6]
test eax, eax
mov eax, 1
cmovne ecx, eax
mov eax, dword [esp + 0x14]
push 0x45f0f4
mov byte [0x46a5d6], cl
push dword [eax + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
movzx ecx, byte [0x46a5d5]
test eax, eax
mov eax, 1
cmovne ecx, eax
mov eax, dword [esp + 0x14]
push 0x45f0fc
mov byte [0x46a5d5], cl
push dword [eax + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
movzx ecx, byte [0x46a5d4]
test eax, eax
mov eax, 1
cmovne ecx, eax
mov eax, dword [esp + 0x14]
inc esi
mov byte [0x46a5d4], cl
mov dword [esp + 8], esi
cmp esi, dword [esp + 0x2c]
jl 0x412de0
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x28]
cmp dword [0x46a830], 1
je 0x4134ee
push 0
push dword [0x46c794]
push 0
push 0
push 0x258
push 0x320
push 0
push 0
push 0x800000
push 0
push 0x4690c8
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esp + 8], eax
test eax, eax
jne 0x41322e
push 0x10
push str.Error_
push str.Window_Creation_Failed_
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4131e2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4131f9
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x4126c4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.0041ae8f
mov esp, ebp
pop ebp
ret 0x10
push 0xfffffffffffffff0
push eax
mov dword [0x46bd1c], eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xff3fffff
or eax, 0x800000
push eax
push 0xfffffffffffffff0
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowLongW]
cmp dword [0x46a830], 0
jne 0x413261
push dword [ebp + 0x14]
jmp 0x413263
push 0
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
push dword [0x46bd1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
push 1
push 0
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0
push 0
push 5
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x4133b5
mov esi, dword [esp + 8]
nop dword [eax + eax]
cmp dword [esp + 0x34], 0x100
jne 0x413357
mov eax, dword [esp + 0x38]
cmp eax, 0xd
jne 0x4132e3
mov ecx, esi
call fcn.00412400
jmp 0x413398
cmp eax, 9
je 0x4132f4
cmp eax, 0x20
je 0x4132f4
call fcn.004117c0
jmp 0x413357
call fcn.004117c0
cmp dword [esp + 0x38], 9
jne 0x413329
movups xmm0, xmmword [esp + 0x30]
mov eax, dword [esp + 0x48]
sub esp, 0x1c
mov ecx, esp
movups xmmword [ecx], xmm0
movq xmm0, qword [esp + 0x5c]
movq qword [ecx + 0x10], xmm0
mov dword [ecx + 0x18], eax
call fcn.00411970
add esp, 0x1c
jmp 0x413398
cmp dword [esp + 0x38], 0x20
jne 0x413357
movups xmm0, xmmword [esp + 0x30]
mov eax, dword [esp + 0x48]
sub esp, 0x1c
mov ecx, esp
movups xmmword [ecx], xmm0
movq xmm0, qword [esp + 0x5c]
movq qword [ecx + 0x10], xmm0
mov dword [ecx + 0x18], eax
call fcn.004120b0
add esp, 0x1c
cmp dword [esp + 0x38], 0x1b
jne 0x413372
push 0
push 0
push 0x10
push dword [0x46bd1c]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x413398
lea eax, [esp + 0x30]
push eax
push esi
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x413398
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x4132c0
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x38]
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov dword [esp + 0x10], eax
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4133d7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4133ee
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x413407
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x10]
pop edi
pop esi
xor ecx, esp
call fcn.0041ae8f
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00402240
mov ecx, str.SetupSilentUAC
call fcn.004057b0
push 1
call fcn.0041f47e
mov ecx, esp
push 0x46c73c
call fcn.00414620
push ecx
mov ecx, esp
push str.contextname
call fcn.00414580
push ecx
mov ecx, esp
push str._ContextMenu_
call fcn.00414580
lea ecx, [esp + 0x1c]
call fcn.00403a60
add esp, 0xc
lea ecx, [esp + 0x1c]
push eax
call fcn.00414400
lea ecx, [esp + 0x10]
call fcn.00414470
lea ecx, [esp + 0x1c]
call fcn.00413c90
test al, al
mov edx, str._s.exe__si_This_performs_an_unattended_installation_with_default_options.__silently__r_n_s.exe__Dir_pathname__Replace_default_folder_with_custom_installation_path._r_nmore_parameters_r_n_re_Create_system_restore_point_r_n_st_Create_start_menu_entries_r_n_de_Create_desktop_shortcut_r_n_la_Launch_program_after_installation_r_n_up_automatically_check_for_updates_r_n_us_install_for_all_users_r_n_lg_installs_with_a_language_file_identified_by_the_locale_ID___s.exe__lglang_en__r_n_s.exe__si__dirC:DirectoryToInstall__re__st_r_nwould_silently_install__s.exe_in_the_C:DirectoryToInstall_folder__create_a_system_restore_point_and_create_start_menu_entries_r_n
mov ecx, str._s.exe__si_This_performs_an_unattended_installation_with_default_options.__silently__r_n_s.exe__Dir_pathname__Replace_default_folder_with_custom_installation_path._r_nmore_parameters_r_n_re_Create_system_restore_point_r_n_st_Create_start_menu_entries_r_n_de_Create_desktop_shortcut_r_n_la_Launch_program_after_installation_r_n_up_automatically_check_for_updates_r_n_us_install_for_all_users_r_n_lg_installs_with_a_language_file_identified_by_the_locale_ID___s.exe__lglang_en__r_n_co_create_context_menu_entries_r_n_s.exe__si__dirC:DirectoryToInstall__re__st_r_nwould_silently_install__s.exe_in_the_C:DirectoryToInstall_folder__create_a_system_restore_point_and_create_start_menu_entries_r_n
cmove ecx, edx
push ecx
lea ecx, [esp + 0x2c]
call fcn.004143b0
push 0x46b2b0
push 0x46b2b0
push 0x46b2b0
push 0x46b2b0
lea ecx, [esp + 0x38]
call fcn.00414650
push eax
mov eax, ecx
push eax
call fcn.004168c0
add esp, 0x18
lea ecx, [esp + 0x28]
push 0
push 0x40
push str.RegCool_Help
call fcn.00414650
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
push 1
call fcn.0041f47e
push 0x46c158
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
call fcn.00410bb0
mov ecx, dword [esp + 0x10]
call fcn.0040b660
push 1
call fcn.0041f47e
int3