Function at 0x40d020
Capabilities:
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45d790
mov eax, dword fs:[0]
push eax
sub esp, 0x618
mov eax, dword [0x47b06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x570]
mov dword [ebp - 0x60c], 0
call fcn.0040a780
lea ecx, [ebp - 0x588]
call fcn.0040ab10
mov byte [ebp - 0x5f5], 0
call fcn.0040bf20
mov byte [ebp - 0x5f6], al
lea eax, [ebp - 0x528]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
or edi, 0xffffffff
test eax, eax
js 0x40d3a6
lea ecx, [ebp - 0x528]
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x52c], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x540], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d0c4
sub ecx, edx
lea eax, [ebp - 0x528]
push ecx
push eax
lea ecx, [ebp - 0x540]
call fcn.00401370
push str.ASUSARMOURY_CRATE_DiagnosisAsusLog_atkexcom_AxIns.log
lea ecx, [ebp - 0x540]
call fcn.004010f0
cmp dword [ebp - 0x52c], 0x10
lea edx, [ebp - 0x540]
mov dword [ebp - 0x8c], 0
cmovae edx, dword [ebp - 0x540]
mov ecx, edx
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x548], 0
mov dword [ebp - 0x544], 0xf
lea esi, [ecx + 1]
mov byte [ebp - 0x558], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40d143
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x558]
call fcn.00401370
push 9
push str.AxIns.exe
lea ecx, [ebp - 0x5e8]
mov dword [ebp - 0x5d8], 0
mov dword [ebp - 0x5d4], 0xf
mov byte [ebp - 0x5e8], 0
call fcn.00401370
sub esp, 0x18
mov byte [ebp - 0x600], 0
lea eax, [ebp - 0x5e8]
mov dword [ebp - 0x608], 3
mov ecx, esp
mov dword [ebp - 0x5fc], 0x500000
push eax
call fcn.00401b10
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x600]
push eax
lea eax, [ebp - 0x608]
push eax
lea eax, [ebp - 0x5fc]
push eax
lea edx, [ebp - 0x558]
lea ecx, [ebp - 0x5f0]
call fcn.00417bd0
mov edx, dword [ebp - 0x5d4]
add esp, 0x28
cmp edx, 0x10
jb 0x40d21c
mov ecx, dword [ebp - 0x5e8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d212
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e3aa
push edx
push ecx
call fcn.0042736a
add esp, 8
mov edx, dword [ebp - 0x544]
cmp edx, 0x10
jb 0x40d256
mov ecx, dword [ebp - 0x558]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d24c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e3af
push edx
push ecx
call fcn.0042736a
add esp, 8
lea ecx, [ebp - 0xb0]
call fcn.00408cf0
sub esp, 0x18
mov ecx, esp
push 0x26
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
push str._Y__m__d__H:_M:_S._e_P:_P_T:_t__l_:__v
mov byte [ecx], 0
call fcn.00401370
call fcn.00408a50
add esp, 0x18
push 0
push 3
call fcn.00408850
mov ecx, eax
call fcn.00417db0
call fcn.00408850
mov ebx, eax
push ebx
call fcn.004260a7
add esp, 4
test eax, eax
je 0x40d2b8
push eax
call fcn.00426278
add esp, 4
mov ecx, dword [ebx + 0x94]
mov eax, dword [ecx]
cmp eax, ecx
je 0x40d2d7
mov esi, dword [eax + 0x20]
mov edx, 1
add esi, 0x2c
xchg dword [esi], edx
mov eax, dword [eax]
cmp eax, ecx
jne 0x40d2c4
mov dword [ebx + 0xd4], 1
push ebx
mov dword [ebp - 4], 0
call fcn.004260cc
add esp, 4
test eax, eax
je 0x40d2fe
push eax
call fcn.00426278
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x5ec]
test edx, edx
je 0x40d319
lock inc dword [edx + 4]
mov edx, dword [ebp - 0x5ec]
mov ecx, dword [ebp - 0x5f0]
sub esp, 8
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], edx
call fcn.00408850
mov ecx, eax
call fcn.004084f0
mov dword [ebp - 4], 2
mov esi, dword [ebp - 0x5ec]
test esi, esi
je 0x40d365
mov eax, edi
lock xadd dword [esi + 4], eax
jne 0x40d365
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, edi
lock xadd dword [esi + 8], eax
jne 0x40d365
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x52c]
cmp edx, 0x10
jb 0x40d3a6
mov ecx, dword [ebp - 0x540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d39c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e3b4
push edx
push ecx
call fcn.0042736a
add esp, 8
call fcn.00408850
sub esp, 8
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
mov ecx, dword [eax + 0x114]
mov eax, esp
push 1
sub esp, 0xc
mov dword [eax], 0x4701a4
mov dword [eax + 4], 0x2f
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00405a70
lea edx, [ebp - 0x5fc]
mov dword [ebp - 0x5fc], 0
lea ecx, [ebp - 0x5e8]
call fcn.0040ce30
mov eax, dword [ebp - 0x5fc]
lea edx, [ebp - 0x5fc]
lea ecx, [ebp - 0x5d0]
mov dword [ebp - 0x5fc], eax
call fcn.0040ce30
mov eax, dword [ebp - 0x5fc]
lea edx, [ebp - 0x608]
lea ecx, [ebp - 0x5b8]
mov dword [ebp - 0x608], eax
call fcn.0040ce30
cmp dword [ebp - 0x5bc], 8
lea edx, [ebp - 0x5d0]
mov eax, dword [ebp - 0x5c0]
lea ebx, [ebp - 0x5d0]
cmovae edx, dword [ebp - 0x5d0]
lea ecx, [ebp - 0x540]
cmovae ebx, dword [ebp - 0x5d0]
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x52c], 0xf
lea esi, [edx + eax*2]
mov byte [ebp - 0x540], 0
mov eax, esi
sub eax, ebx
sar eax, 1
push eax
call fcn.00401c60
push dword [ebp - 0x604]
lea ecx, [ebp - 0x540]
push esi
push ebx
call fcn.00418860
call fcn.00408850
push 0x14
push str.ppid____name_:_
mov dword [ebp - 0x5f4], 0
mov ecx, dword [eax + 0x114]
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x5fc]
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
push eax
sub esp, 0x10
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.0041d8b0
mov edx, dword [ebp - 0x52c]
cmp edx, 0x10
jb 0x40d540
mov ecx, dword [ebp - 0x540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d536
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e3b9
push edx
push ecx
call fcn.0042736a
add esp, 8
cmp dword [ebp - 0x5a4], 8
lea edx, [ebp - 0x5b8]
mov eax, dword [ebp - 0x5a8]
lea ebx, [ebp - 0x5b8]
cmovae edx, dword [ebp - 0x5b8]
lea ecx, [ebp - 0x540]
cmovae ebx, dword [ebp - 0x5b8]
mov dword [ebp - 0x530], 0
mov dword [ebp - 0x52c], 0xf
lea esi, [edx + eax*2]
mov byte [ebp - 0x540], 0
mov eax, esi
sub eax, ebx
sar eax, 1
push eax
call fcn.00401c60
push dword [ebp - 0x604]
lea ecx, [ebp - 0x540]
push esi
push ebx
call fcn.00418860
call fcn.00408850
push 0x15
push str.pppid____name_:_
mov dword [ebp - 0x5f4], 0
mov ecx, dword [eax + 0x114]
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x608]
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
push eax
sub esp, 0x10
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.0041d8b0
mov edx, dword [ebp - 0x52c]
cmp edx, 0x10
jb 0x40d635
mov ecx, dword [ebp - 0x540]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40d62b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e3be
push edx
push ecx
call fcn.0042736a
add esp, 8
call fcn.00408850
push 0x14
push str.main:_targetVer__
mov dword [ebp - 0x5f4], 0
mov ecx, dword [eax + 0x114]
lea eax, [ebp - 0x570]
push eax
sub esp, 0x10
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.0041b420
call fcn.00408850
push 0x15
push str.main:_currentVer__
mov dword [ebp - 0x5f4], 0
mov ecx, dword [eax + 0x114]
lea eax, [ebp - 0x588]
push eax
sub esp, 0x10
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.0041b420
call fcn.00408850
push 0x11
push str.main:_bExist__
mov dword [ebp - 0x5f4], 0
mov ecx, dword [eax + 0x114]
lea eax, [ebp - 0x5f6]
push eax
sub esp, 0x10
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.0041db60
cmp dword [ebp - 0x560], 0
jne 0x40d793
cmp dword [ebp - 0x578], 0
jne 0x40d793
call fcn.00408850
sub esp, 8
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
mov ecx, dword [eax + 0x114]
mov eax, esp
push 1
sub esp, 0xc
mov dword [eax], str.main:_targetVer_and_currentVer_are_empty
mov dword [eax + 4], 0x28
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00405a70
lea ecx, [ebp - 0x5f0]
call fcn.00408c30
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 4], 3
jmp 0x40d9a3
push 1
lea eax, [ebp - 0x53c]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x53c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x53c]
mov dword [ebp - 0x5f4], 0xc
push 0x46ffa8
mov dword [ebp - 0x5f0], eax
lea eax, [ebp - 0x5f4]
push 0
push eax
mov dword [ebp - 0x5ec], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x48037c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.00408850
sub esp, 8
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
mov ecx, dword [eax + 0x114]
mov eax, esp
push 1
sub esp, 0xc
mov dword [eax], str.acquire_gEnterSetupMutex
mov dword [eax + 4], 0x18
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00405a70
call fcn.0040c700
call fcn.00408850
sub esp, 8
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
mov ecx, dword [eax + 0x114]
mov eax, esp
push 1
sub esp, 0xc
mov dword [eax], str.get_gEnterSetupMutex
mov dword [eax + 4], 0x14
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00405a70
cmp dword [ebp - 0x55c], 0x10
lea ecx, [ebp - 0x570]
mov edx, dword [ebp - 0x588]
lea ebx, [ebp - 0x570]
cmovae ecx, dword [ebp - 0x570]
lea esi, [ebp - 0x588]
add ecx, dword [ebp - 0x560]
cmp dword [ebp - 0x55c], 0x10
mov eax, dword [ebp - 0x578]
cmovae ebx, dword [ebp - 0x570]
cmp dword [ebp - 0x574], 0x10
cmovae esi, edx
add eax, esi
cmp dword [ebp - 0x574], 0x10
lea esi, [ebp - 0x588]
cmovae esi, edx
cmp esi, eax
je 0x40d920
nop dword [eax]
cmp ebx, ecx
je 0x40d91c
mov dl, byte [esi]
mov dh, byte [ebx]
cmp dl, dh
jl 0x40d9ef
cmp dh, dl
jl 0x40d928
inc esi
inc ebx
cmp esi, eax
jne 0x40d900
jmp 0x40d920
cmp esi, eax
jne 0x40d928
cmp ebx, ecx
jne 0x40d9ef
cmp byte [ebp - 0x5f6], 0
je 0x40d9e8
call fcn.0040cd10
call fcn.00408850
sub esp, 8
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
mov ecx, dword [eax + 0x114]
mov eax, esp
push 1
sub esp, 0xc
mov dword [eax], str.release_gLeaveSetupMutex
mov dword [eax + 4], 0x18
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00405a70
lea ecx, [ebp - 0x5f0]
call fcn.00408c30
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 4], 4
mov esi, dword [ebp - 0x5ec]
test esi, esi
je 0x40d9ce
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x40d9ce
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x40d9ce
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
call fcn.00408850
mov ecx, eax
call fcn.00408660
xor esi, esi
jmp 0x40e205
mov byte [ebp - 0x5f5], 1
sub esp, 0x18
lea eax, [ebp - 0x570]
mov ecx, esp
push eax
call fcn.00401b10
lea ecx, [ebp - 0x5a0]
call fcn.0040ad80
add esp, 0x18
call fcn.00408850
push 0x19
push str.main:_bForceCopy____
mov dword [ebp - 0x5f4], 0
mov ecx, dword [eax + 0x114]
lea eax, [ebp - 0x5a0]
push eax
lea eax, [ebp - 0x5f5]
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
push eax
sub esp, 0x10
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.0041de00
lea ecx, [ebp - 0x558]
call fcn.00402830
cmp byte [ebp - 0x5f5], 0
lea edx, [ebp - 0x5a0]
mov ecx, eax
je 0x40dd20
call fcn.0040b450
mov edx, dword [ebp - 0x544]
cmp edx, 0x10
jb 0x40dabe
mov ecx, dword [ebp - 0x558]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40dab4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e3c3
push edx
push ecx
call fcn.0042736a
add esp, 8
call fcn.00408850
sub esp, 8
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
mov ecx, dword [eax + 0x114]
mov eax, esp
push 1
sub esp, 0xc
mov dword [eax], str.main:_UnRegisterATKService
mov dword [eax + 4], 0x1a
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00405a70
call fcn.0040b9a0
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
call fcn.00408850
sub esp, 8
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
mov ecx, dword [eax + 0x114]
mov eax, esp
push 1
sub esp, 0xc
mov dword [eax], str.main:_delete_register
mov dword [eax + 4], 0x15
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00405a70
push ecx
push str.SOFTWAREClassesCLSID2627F8BE_4482_4081_BC62_8A12CA24BDF8
push ecx
mov edx, 0x208
lea ecx, [ebp - 0x420]
call fcn.004029c0
push 1
lea edx, [ebp - 0x420]
call fcn.00409650
push str.SOFTWAREClassesCLSID2627F8BE_4482_4081_BC62_8A12CA24BDF8
push ecx
mov edx, 0x208
lea ecx, [ebp - 0x420]
call fcn.004029c0
push 0
lea edx, [ebp - 0x420]
call fcn.00409650
push str.SOFTWAREASUSAXSP
push ecx
mov edx, 0x208
lea ecx, [ebp - 0x420]
call fcn.004029c0
push 1
lea edx, [ebp - 0x420]
call fcn.00409650
push str.SOFTWAREASUSAXSP
push ecx
mov edx, 0x208
lea ecx, [ebp - 0x420]
call fcn.004029c0
push 0
lea edx, [ebp - 0x420]
call fcn.00409650
add esp, 4
call fcn.00408850
sub esp, 8
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
mov ecx, dword [eax + 0x114]
mov eax, esp
push 1
sub esp, 0xc
mov dword [eax], str.main:_RegisterService
mov dword [eax + 4], 0x15
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00405a70
lea ecx, [ebp - 0x5a0]
call fcn.0040bbf0
mov bl, al
test bl, bl
je 0x40dcbe
call fcn.00408850
sub esp, 8
mov dword [ebp - 0x5f4], 0
mov ecx, esp
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
mov edx, dword [eax + 0x114]
push 1
sub esp, 0xc
mov dword [ecx], str.main:_RegisterService__sucessfully
mov eax, esp
mov dword [ecx + 4], 0x22
mov ecx, edx
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00405a70
call fcn.0040c120
push 0x64
call esi
call fcn.0040c500
mov byte [ebp - 0x618], 0
mov dword [ebp - 0x614], 0
mov dword [ebp - 0x610], 0
test bl, bl
je 0x40de3e
lea ecx, [ebp - 0x558]
call fcn.0040a060
cmp dword [eax + 0x14], 0x10
jb 0x40dcf4
mov eax, dword [eax]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x61c]
mov dword [ebp - 0x60c], 1
call fcn.00425690
test al, al
je 0x40de3e
mov bl, 1
mov eax, 1
jmp 0x40de46
call fcn.0040b020
lea ecx, [ebp - 0x558]
mov bl, al
call fcn.00401160
test bl, bl
jne 0x40dabe
call fcn.00408850
sub esp, 8
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
mov ecx, dword [eax + 0x114]
mov eax, esp
push 1
sub esp, 0xc
mov dword [eax], str.main:_CopyData__fail
mov dword [eax + 4], 0x15
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00405a70
call fcn.0040cd10
call fcn.00408850
sub esp, 8
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
mov ecx, dword [eax + 0x114]
mov eax, esp
push 1
sub esp, 0xc
mov dword [eax], str.release_gLeaveSetupMutex
mov dword [eax + 4], 0x18
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00405a70
lea ecx, [ebp - 0x5f0]
call fcn.00408c30
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 4], 5
mov esi, dword [ebp - 0x5ec]
test esi, esi
je 0x40de23
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x40de23
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x40de23
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
call fcn.00408850
mov ecx, eax
call fcn.00408660
or esi, 0xffffffff
jmp 0x40e1b0
mov eax, dword [ebp - 0x60c]
xor bl, bl
test al, 1
je 0x40de55
lea ecx, [ebp - 0x558]
call fcn.00401160
test bl, bl
je 0x40df89
lea ecx, [ebp - 0x540]
call fcn.0040a3f0
push eax
lea edx, [ebp - 0x5a0]
lea ecx, [ebp - 0x558]
call fcn.00412500
add esp, 4
lea ecx, [ebp - 0x540]
call fcn.00401160
call fcn.00408850
push 0xa
push str.VERSION_
mov dword [ebp - 0x5f4], 0
mov ecx, dword [eax + 0x114]
lea eax, [ebp - 0x570]
push eax
sub esp, 0x10
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.0041b420
call fcn.00408850
push 0xa
push str.EXEPATH_
mov dword [ebp - 0x5f4], 0
mov ecx, dword [eax + 0x114]
lea eax, [ebp - 0x558]
push eax
sub esp, 0x10
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.0041b420
cmp dword [ebp - 0x55c], 0x10
lea ecx, [ebp - 0x570]
mov eax, dword [ebp - 0x560]
cmovae ecx, dword [ebp - 0x570]
inc eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
push ecx
push 1
push 0
push str.VERSION
push dword [ebp - 0x61c]
call esi
cmp dword [ebp - 0x544], 0x10
lea ecx, [ebp - 0x558]
mov eax, dword [ebp - 0x548]
cmovae ecx, dword [ebp - 0x558]
inc eax
push eax
push ecx
push 1
push 0
push str.EXEPATH
push dword [ebp - 0x61c]
call esi
lea ecx, [ebp - 0x558]
call fcn.00401160
lea ecx, [ebp - 0x61c]
call fcn.00425760
cmp dword [ebp - 0x578], 0
jne 0x40e0a4
call fcn.00408850
sub esp, 8
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
mov ecx, dword [eax + 0x114]
mov eax, esp
push 1
sub esp, 0xc
mov dword [eax], str.new_install
mov dword [eax + 4], 0xb
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00405a70
call fcn.0040cd10
call fcn.00408850
sub esp, 8
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
mov ecx, dword [eax + 0x114]
mov eax, esp
push 1
sub esp, 0xc
mov dword [eax], str.release_gLeaveSetupMutex
mov dword [eax + 4], 0x18
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00405a70
lea ecx, [ebp - 0x5f0]
call fcn.00408c30
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 4], 6
mov esi, dword [ebp - 0x5ec]
test esi, esi
je 0x40e08a
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x40e08a
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x40e08a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
call fcn.00408850
mov ecx, eax
call fcn.00408660
xor esi, esi
jmp 0x40e1a5
call fcn.00408850
sub esp, 8
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
mov ecx, dword [eax + 0x114]
mov eax, esp
push 1
sub esp, 0xc
mov dword [eax], str.update
mov dword [eax + 4], 6
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00405a70
call fcn.0040cd10
call fcn.00408850
sub esp, 8
mov dword [ebp - 0x5f4], 0
mov dword [ebp - 0x5f0], 0
movq xmm0, qword [ebp - 0x5f4]
mov ecx, dword [eax + 0x114]
mov eax, esp
push 1
sub esp, 0xc
mov dword [eax], str.release_gLeaveSetupMutex
mov dword [eax + 4], 0x18
mov eax, esp
movq qword [eax], xmm0
mov dword [eax + 8], 0
call fcn.00405a70
lea ecx, [ebp - 0x624]
call fcn.00408c30
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 4], 7
mov esi, dword [ebp - 0x620]
test esi, esi
je 0x40e18d
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x40e18d
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x40e18d
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
call fcn.00408850
mov ecx, eax
call fcn.00408660
mov esi, 1
lea ecx, [ebp - 0x61c]
call fcn.00425760
mov edx, dword [ebp - 0x58c]
cmp edx, 0x10
jb 0x40e1ea
mov ecx, dword [ebp - 0x5a0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e1e0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e3c8
push edx
push ecx
call fcn.0042736a
add esp, 8
mov dword [ebp - 0x590], 0
mov dword [ebp - 0x58c], 0xf
mov byte [ebp - 0x5a0], 0
mov edx, dword [ebp - 0x5a4]
cmp edx, 8
jb 0x40e245
mov ecx, dword [ebp - 0x5b8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e23b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e3cd
push edx
push ecx
call fcn.0042736a
add esp, 8
mov edx, dword [ebp - 0x5bc]
xor eax, eax
mov dword [ebp - 0x5a8], 0
mov dword [ebp - 0x5a4], 7
mov word [ebp - 0x5b8], ax
cmp edx, 8
jb 0x40e2a2
mov ecx, dword [ebp - 0x5d0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e298
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e3d2
push edx
push ecx
call fcn.0042736a
add esp, 8
mov edx, dword [ebp - 0x5d4]
xor eax, eax
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x5bc], 7
mov word [ebp - 0x5d0], ax
cmp edx, 8
jb 0x40e2ff
mov ecx, dword [ebp - 0x5e8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x40e2f5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e3d7
push edx
push ecx
call fcn.0042736a
add esp, 8
mov edx, dword [ebp - 0x574]
cmp edx, 0x10
jb 0x40e339
mov ecx, dword [ebp - 0x588]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e32f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e3dc
push edx
push ecx
call fcn.0042736a
add esp, 8
mov edx, dword [ebp - 0x55c]
mov dword [ebp - 0x578], 0
mov dword [ebp - 0x574], 0xf
mov byte [ebp - 0x588], 0
cmp edx, 0x10
jb 0x40e38a
mov ecx, dword [ebp - 0x570]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40e380
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40e3e1
push edx
push ecx
call fcn.0042736a
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00427329
mov esp, ebp
pop ebp
ret 0x10
call fcn.004421bc
call fcn.004421bc
call fcn.004421bc
call fcn.004421bc
call fcn.004421bc
call fcn.004421bc
call fcn.004421bc
call fcn.004421bc
call fcn.004421bc
call fcn.004421bc
call fcn.004421bc
call fcn.004421bc
int3