Function at 0x4026b0
Capabilities:
Check for time delay via queryperformancecounter
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x47cd3e
mov eax, dword fs:[0]
push eax
sub esp, 0x6c0
mov eax, dword [0x49ffb8]
xor eax, esp
mov dword [esp + 0x6b8], eax
push ebx
push esi
push edi
mov eax, dword [0x49ffb8]
xor eax, esp
push eax
lea eax, [esp + 0x6d0]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov byte [eax], 0
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x38], esi
mov byte [ecx], 0
xor edi, edi
mov cl, byte [edx + 8]
movsx eax, cl
mov dword [esp + 0x28], edi
mov byte [esp + 0x17], cl
cmp eax, 8
ja case.0x402734.0
movzx eax, byte [eax + 0x403f30]
jmp dword [eax*4 + 0x403f24]
mov esi, dword [edx]
cmp dword [esi + 4], 0
je case.0x402734.0
mov eax, dword [esi]
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], eax
call fcn.0040b210
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x58], eax
lea eax, [ecx + 1]
mov cl, byte [esp + 0x17]
jmp 0x402772
mov esi, dword [edx]
mov eax, dword [esi + 4]
cmp edi, eax
jae case.0x402734.0
test cl, cl
jne 0x402785
mov edi, 0x4a34c0
jmp 0x4027fe
mov dword [esp + 0xbc], 0
mov dword [esp + 0xc4], edi
mov dword [esp + 0xc8], 0
mov byte [esp + 0xcc], 1
lea eax, [esp + 0xbc]
push eax
mov ecx, esi
call fcn.0042a9b0
mov ecx, dword [esi]
cmp eax, ecx
je 0x4027d7
xor edx, edx
cmp edx, dword [eax + 0x1c]
jl 0x4027d7
jg 0x4027cd
cmp edi, dword [eax + 0x18]
jb 0x4027d7
mov dword [esp + 0x34], eax
lea eax, [esp + 0x34]
jmp 0x4027df
mov dword [esp + 0x3c], ecx
lea eax, [esp + 0x3c]
mov ecx, dword [esp + 0x30]
mov eax, dword [eax]
mov ecx, dword [ecx]
mov dword [esp + 0x6d8], 0xffffffff
mov edi, 0x4a34c0
cmp eax, dword [ecx]
je 0x4027fe
lea edi, [eax + 0x28]
push str.Elevate
mov ecx, edi
mov dword [esp + 0x1c], edi
call fcn.00429640
cmp eax, 0x4a34c0
je 0x402837
push str.Elevate
mov ecx, edi
call fcn.00429640
mov ecx, eax
call fcn.00428b90
cmp eax, 1
jne 0x402837
cmp byte [ebx + 4], 0
je 0x4036b9
push str.Complete
mov ecx, edi
call fcn.00429640
cmp eax, 0x4a34c0
je 0x402a41
push str.Complete
mov ecx, edi
call fcn.00429640
mov ecx, eax
call fcn.00428b90
cmp eax, 1
jne 0x402a41
lea eax, [esp + 0xbc]
push eax
push ecx
push str.Target
mov ecx, edi
call fcn.00429640
add esp, 4
mov ecx, eax
call fcn.00428aa0
push str.Parameters
mov ecx, edi
mov dword [esp + 0x6dc], 1
call fcn.00429640
cmp eax, 0x4a34c0
je 0x402958
lea eax, [esp + 0x104]
push eax
push ecx
push str.Parameters
mov ecx, edi
call fcn.00429640
add esp, 4
mov ecx, eax
call fcn.00428aa0
push eax
mov edx, 0x48d434
lea ecx, [esp + 0x90]
mov byte [esp + 0x6dc], 2
call fcn.004076b0
add esp, 4
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0xc8]
mov byte [esp + 0x6e4], 3
call fcn.00406250
cmp dword [esp + 0xa0], 0x10
jb 0x402919
push dword [esp + 0x8c]
call fcn.0043d98b
add esp, 4
mov byte [esp + 0x6d8], 1
cmp dword [esp + 0x118], 0x10
mov dword [esp + 0xa0], 0xf
mov dword [esp + 0x9c], 0
mov byte [esp + 0x8c], 0
jb 0x402958
push dword [esp + 0x104]
call fcn.0043d98b
add esp, 4
cmp dword [0x4a1a34], 3
jl 0x402a0b
mov dword [esp + 0x4c], vtable.Log.0
call fcn.0041ddc0
mov esi, eax
lea eax, [esp + 0xfc]
push eax
mov dword [esp + 0x54], esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0xfc]
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x100]
mov dword [esi + 0x14], ecx
call fcn.0042f280
mov dword [esi + 0x18], eax
mov byte [esp + 0x6d8], 4
mov dword [esi + 8], 3
mov eax, dword [esi + 4]
test eax, eax
je 0x4029bd
add eax, 0x10
jmp 0x4029bf
xor eax, eax
push dword [esp + 0x28]
push ecx
push str.____action_index:
push ecx
lea ecx, [esp + 0xcc]
push ecx
push ecx
push str.ActionProcessor::Process:_skipping_currentAction_because_already_completed__
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 0xc
push eax
call fcn.00407740
add esp, 0xc
mov ecx, eax
call fcn.00404210
lea ecx, [esp + 0x4c]
mov byte [esp + 0x6d8], 1
call fcn.0041dee0
mov dword [esp + 0x6d8], 0xffffffff
cmp dword [esp + 0xd0], 0x10
jb 0x4036b9
push dword [esp + 0xbc]
call fcn.0043d98b
mov edi, dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
add esp, 4
inc edi
jmp 0x402716
mov dword [esp + method.Json::StyledWriter.virtual_0], vtable.Json::StyledWriter.0
mov dword [esp + 0x120], 0
mov dword [esp + 0x124], 0
mov dword [esp + 0x128], 0
mov dword [esp + 0x140], 0xf
mov dword [esp + 0x13c], 0
mov byte [esp + 0x12c], 0
mov dword [esp + 0x158], 0xf
mov dword [esp + 0x154], 0
mov byte [esp + 0x144], 0
mov dword [esp + 0x15c], 0x4a
mov dword [esp + 0x160], 3
mov dword [esp + 0x6d8], 5
cmp dword [0x4a1a34], 3
jl 0x402bd6
mov dword [esp + 0xec], vtable.Log.0
call fcn.0041ddc0
mov esi, eax
lea eax, [esp + 0xf4]
push eax
mov dword [esp + 0xf4], esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0xf4]
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0xf8]
mov dword [esi + 0x14], ecx
call fcn.0042f280
mov dword [esi + 0x18], eax
mov byte [esp + 0x6d8], 6
mov dword [esi + 8], 3
mov esi, dword [esi + 4]
test esi, esi
je 0x402b35
add esi, 0x10
jmp 0x402b37
xor esi, esi
push edi
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x124]
call fcn.00426c20
push eax
push ecx
push str._value:
push ecx
mov byte [esp + 0x6e8], 7
push dword [esp + 0x38]
push ecx
push str.ActionProcessor::Process:_now_processing_action_index:
push esi
call fcn.00407740
add esp, 0xc
mov ecx, eax
call fcn.00404210
add esp, 4
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 8
cmp dword [esp + 0xa0], 0x10
jb 0x402ba4
push dword [esp + 0x8c]
call fcn.0043d98b
add esp, 4
lea ecx, [esp + 0xec]
mov dword [esp + 0xa0], 0xf
mov dword [esp + 0x9c], 0
mov byte [esp + 0x8c], 0
mov byte [esp + 0x6d8], 5
call fcn.0041dee0
lea eax, [esp + 0xa4]
push eax
push ecx
push str.Action
mov ecx, edi
call fcn.00429640
add esp, 4
mov ecx, eax
call fcn.00428aa0
mov byte [esp + 0x6d8], 8
cmp dword [esp + 0xb8], 0x10
mov edx, dword [esp + 0xb4]
lea ecx, [esp + 0xa4]
cmovae ecx, dword [esp + 0xa4]
mov esi, 7
cmp edx, esi
cmovb esi, edx
test esi, esi
je 0x402c8a
mov edx, str.Execute
sub esi, 4
jb 0x402c44
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x402c49
add ecx, 4
add edx, 4
sub esi, 4
jae 0x402c33
cmp esi, 0xfffffffc
je 0x402c7d
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x402c76
cmp esi, 0xfffffffd
je 0x402c7d
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x402c76
cmp esi, 0xfffffffe
je 0x402c7d
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x402c76
cmp esi, 0xffffffff
je 0x402c7d
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x402c7d
sbb eax, eax
or eax, 1
jmp 0x402c7f
xor eax, eax
mov edx, dword [esp + 0xb4]
test eax, eax
jne 0x402c9e
cmp edx, 7
jae 0x402c94
or eax, 0xffffffff
jmp 0x402c9c
xor eax, eax
cmp edx, 7
setne al
test eax, eax
sete al
test al, al
je 0x4030a7
lea eax, [esp + 0xbc]
push eax
push ecx
push str.CacheBaseDir
mov ecx, edi
mov dword [esp + 0x60], vtable.._AVInterruptOnClientShutdown__BP___Process_ActionProcessor__UAEXABVValue_Json__AA_N11_Z_.0
call fcn.00429640
add esp, 4
mov ecx, eax
call fcn.00428aa0
mov edi, eax
lea eax, [esp + 0x104]
push eax
push ecx
mov byte [esp + 0x6e0], 9
mov ecx, dword [esp + 0x20]
push str.DefaultWorkingDirectory
call fcn.00429640
add esp, 4
mov ecx, eax
call fcn.00428aa0
mov esi, eax
lea eax, [esp + 0xd4]
push eax
push ecx
mov byte [esp + 0x6e0], 0xa
mov ecx, dword [esp + 0x20]
push str.DependencyPath
call fcn.00429640
add esp, 4
mov ecx, eax
call fcn.00428aa0
lea ecx, [ebx + 8]
push ecx
mov byte [esp + 0x6dc], 0xb
push dword [esp + 0x1c]
push edi
push esi
push eax
lea eax, [esp + 0x68]
push eax
push ecx
lea ecx, [esp + 0x188]
call fcn.004084d0
cmp dword [esp + 0xe8], 0x10
jb 0x402d64
push dword [esp + 0xd4]
call fcn.0043d98b
add esp, 4
mov dword [esp + 0xe8], 0xf
mov dword [esp + 0xe4], 0
mov byte [esp + 0xd4], 0
cmp dword [esp + 0x118], 0x10
jb 0x402d9b
push dword [esp + 0x104]
call fcn.0043d98b
add esp, 4
mov dword [esp + 0x118], 0xf
mov dword [esp + 0x114], 0
mov byte [esp + 0x104], 0
mov byte [esp + 0x6d8], 0xf
cmp dword [esp + 0xd0], 0x10
jb 0x402dda
push dword [esp + 0xbc]
call fcn.0043d98b
add esp, 4
cmp byte [esp + 0x16c], 0
mov dword [esp + 0xd0], 0xf
mov dword [esp + 0xcc], 0
mov byte [esp + 0xbc], 0
je 0x403901
cmp byte [esp + 0x16d], 0
je 0x403901
cmp byte [esp + 0x6a9], 0
jne 0x402e32
lea ecx, [esp + 0x16c]
call fcn.00409590
test al, al
je 0x4036c7
cmp dword [0x4a1a34], 2
jl 0x402eb9
lea ecx, [esp + 0x5c]
call fcn.0041de50
mov byte [esp + 0x6d8], 0x13
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 2
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x402e65
add eax, 0x10
jmp 0x402e67
xor eax, eax
lea ecx, [esp + 0x644]
push ecx
push ecx
push 0x48d434
push ecx
lea ecx, [esp + 0x21c]
push ecx
push ecx
push str.ActionProcessor::Process:_created_ExecuteAttempt_for
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 0xc
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 8
lea ecx, [esp + 0x5c]
mov byte [esp + 0x6d8], 0xf
call fcn.0041dee0
lea ecx, [esp + 0x16c]
call fcn.004094f0
test al, al
je 0x403859
cmp dword [0x4a1a34], 2
jl 0x402f67
lea ecx, [esp + 0x74]
call fcn.0041de50
mov byte [esp + 0x6d8], 0x16
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 2
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x402f04
add eax, 0x10
jmp 0x402f06
xor eax, eax
push str.__started_successfully
push ecx
lea ecx, [esp + 0x64c]
push ecx
push ecx
push 0x48d434
push ecx
lea ecx, [esp + 0x224]
push ecx
push ecx
push str.ActionProcessor::Process:_Execution_attempt__
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 0xc
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 0xc
push eax
call fcn.00407740
add esp, 8
lea ecx, [esp + 0x74]
mov byte [esp + 0x6d8], 0xf
call fcn.0041dee0
mov edi, dword [esp + 0x18]
mov esi, dword [ebx]
push str.ActionId
mov ecx, edi
call fcn.00429640
mov ecx, eax
call fcn.00428b90
push eax
mov ecx, ebx
call dword [esi + 0x10]
lea ecx, [esp + 0x16c]
call fcn.00409930
test al, al
je 0x403781
cmp byte [esp + 0x6a8], 0
jne 0x402fcf
cmp byte [esp + 0x6ac], 0
mov ecx, dword [ebx + 0x38]
lea eax, [esp + 0x17]
push eax
sete al
movzx eax, al
push 1
push eax
lea eax, [esp + 0x6a8]
push eax
mov byte [esp + 0x27], 0
call fcn.00410cc0
cmp dword [0x4a1a34], 2
jl 0x403069
lea ecx, [esp + 0x7c]
call fcn.0041de50
mov byte [esp + 0x6d8], 0x19
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 2
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x403006
add eax, 0x10
jmp 0x403008
xor eax, eax
push str.__completed_successfully
push ecx
lea ecx, [esp + 0x64c]
push ecx
push ecx
push 0x48d434
push ecx
lea ecx, [esp + 0x224]
push ecx
push ecx
push str.ActionProcessor::Process:_Execution_attempt__
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 0xc
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 0xc
push eax
call fcn.00407740
add esp, 8
lea ecx, [esp + 0x7c]
mov byte [esp + 0x6d8], 0xf
call fcn.0041dee0
push dword [esp + 0x6a4]
mov esi, dword [ebx]
push ecx
push str.ActionId
mov ecx, edi
call fcn.00429640
mov ecx, eax
call fcn.00428b90
add esp, 4
mov ecx, ebx
push eax
call dword [esi + 0xc]
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x16c]
mov byte [eax], 1
call fcn.004091b0
jmp 0x40366b
cmp dword [esp + 0xb8], 0x10
lea ecx, [esp + 0xa4]
cmovae ecx, dword [esp + 0xa4]
mov esi, 0x17
cmp edx, esi
cmovb esi, edx
test esi, esi
je 0x40312d
mov edx, str.CreateFirewallException
sub esi, 4
jb 0x4030e7
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4030ec
add ecx, 4
add edx, 4
sub esi, 4
jae 0x4030d6
cmp esi, 0xfffffffc
je 0x403120
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x403119
cmp esi, 0xfffffffd
je 0x403120
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x403119
cmp esi, 0xfffffffe
je 0x403120
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x403119
cmp esi, 0xffffffff
je 0x403120
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x403120
sbb eax, eax
or eax, 1
jmp 0x403122
xor eax, eax
mov edx, dword [esp + 0xb4]
test eax, eax
jne 0x403141
cmp edx, 0x17
jae 0x403137
or eax, 0xffffffff
jmp 0x40313f
xor eax, eax
cmp edx, 0x17
setne al
test eax, eax
sete al
test al, al
je 0x403395
lea eax, [esp + 0x8c]
push eax
push ecx
push str.ExecutablePath
mov ecx, edi
call fcn.00429640
add esp, 4
mov ecx, eax
call fcn.00428aa0
lea eax, [esp + 0xd4]
push eax
push ecx
push str.FriendlyName
mov ecx, edi
mov byte [esp + 0x6e4], 0x1a
call fcn.00429640
add esp, 4
mov ecx, eax
call fcn.00428aa0
push str.Required
mov ecx, edi
mov byte [esp + 0x6dc], 0x1b
call fcn.00429640
cmp eax, 0x4a34c0
je 0x4031dc
push str.Required
mov ecx, edi
call fcn.00429640
cmp byte [eax + 8], 1
jne 0x4031dc
push str.Required
mov ecx, edi
call fcn.00429640
mov ecx, eax
call fcn.00428b90
mov byte [esp + 0x17], 1
cmp eax, 1
je 0x4031e1
mov byte [esp + 0x17], 0
push str.FileDependenciesReady
mov ecx, edi
call fcn.00429640
cmp eax, 0x4a34c0
je 0x403a71
push str.FileDependenciesReady
mov ecx, edi
call fcn.00429640
mov al, byte [eax + 8]
cmp al, 1
je 0x40321b
cmp al, 2
je 0x40321b
cmp al, 6
je 0x40321b
cmp al, 3
jne 0x403a71
push str.FileDependenciesReady
mov ecx, edi
call fcn.00429640
mov ecx, eax
call fcn.00428cd0
cmp eax, 1
jne 0x403a71
test edx, edx
jne 0x403a71
lea edx, [esp + 0xd4]
lea ecx, [esp + 0x8c]
call fcn.0040e310
test al, al
jne 0x403314
cmp dword [0x4a1a34], 0
jl 0x4032c0
lea ecx, [esp + 0x6c]
call fcn.0041de50
mov byte [esp + 0x6d8], 0x1d
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 0
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x40328d
add eax, 0x10
jmp 0x40328f
xor eax, eax
lea ecx, [esp + 0xd4]
push ecx
push ecx
push str.ActionProcessor::Process:_AuthorizeApplication_failed_for
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 8
lea ecx, [esp + 0x6c]
mov byte [esp + 0x6d8], 0x1b
call fcn.0041dee0
push str.unable_to_authorize_application
lea ecx, [esp + 0xc0]
call fcn.00403fb0
lea ecx, [esp + 0xbc]
mov byte [esp + 0x6d8], 0x1e
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 8]
mov byte [esp + 0x6d8], 0x1b
cmp dword [esp + 0xd0], 0x10
jb 0x403309
push dword [esp + 0xbc]
call fcn.0043d98b
add esp, 4
cmp byte [esp + 0x17], 0
jne 0x403a11
mov esi, dword [ebx]
push 0
push ecx
push str.ActionId
mov ecx, edi
call fcn.00429640
mov ecx, eax
call fcn.00428b90
add esp, 4
mov ecx, ebx
push eax
call dword [esi + 0xc]
cmp dword [esp + 0xe8], 0x10
mov eax, dword [esp + 0x2c]
mov byte [eax], 1
jb 0x403355
push dword [esp + 0xd4]
call fcn.0043d98b
add esp, 4
cmp dword [esp + 0xa0], 0x10
mov dword [esp + 0xe8], 0xf
mov dword [esp + 0xe4], 0
mov byte [esp + 0xd4], 0
jb 0x40366b
push dword [esp + 0x8c]
call fcn.0043d98b
add esp, 4
jmp 0x40366b
cmp dword [esp + 0xb8], 0x10
lea ecx, [esp + 0xa4]
cmovae ecx, dword [esp + 0xa4]
mov eax, 0xa
cmp edx, eax
cmovb eax, edx
push eax
mov edx, str.SetRegKeys
call fcn.00401010
add esp, 4
test eax, eax
jne 0x4033e3
mov ecx, dword [esp + 0xb4]
cmp ecx, 0xa
jae 0x4033d9
or eax, 0xffffffff
jmp 0x4033e1
xor eax, eax
cmp ecx, 0xa
setne al
test eax, eax
sete al
test al, al
jne 0x403c48
lea eax, [esp + 0xa4]
push str.InjectPid
push eax
call fcn.00407c50
add esp, 8
test al, al
je 0x4034d5
push 0x48d948
mov ecx, edi
call fcn.00429640
mov ecx, eax
call fcn.00428b90
cmp dword [0x4a1a34], 2
mov esi, eax
jl 0x40347d
lea ecx, [esp + 0x64]
call fcn.0041de50
mov byte [esp + 0x6d8], 0x26
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 2
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x403453
add eax, 0x10
jmp 0x403455
xor eax, eax
push esi
push ecx
push str.ActionProcessor::Process:_InjectPid
push eax
call fcn.00407740
add esp, 0xc
mov ecx, eax
call fcn.00404210
lea ecx, [esp + 0x64]
mov byte [esp + 0x6d8], 8
call fcn.0041dee0
mov dword [esp + 0x40], vtable.HappyCloud::ProcessWrapper.0
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x48], esi
lea ecx, [esp + 0x40]
mov byte [esp + 0x6d8], 0x27
call fcn.0040d630
test al, al
je 0x4034c8
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x17], 0
mov byte [eax], 1
mov ecx, dword [ebx + 0x38]
lea eax, [esp + 0x17]
push eax
push 0
push 1
lea eax, [esp + 0x4c]
push eax
call fcn.00410cc0
mov dword [esp + 0x40], vtable.HappyCloud::ProcessWrapper.0
jmp 0x40366b
lea eax, [esp + 0xa4]
push str.Shutdown
push eax
call fcn.00407c50
add esp, 8
test al, al
jne 0x403beb
lea eax, [esp + 0xa4]
push str.CreateDirectory
push eax
call fcn.00407c50
add esp, 8
test al, al
je 0x40366b
lea eax, [esp + 0x8c]
push eax
push ecx
push str.Directory
mov ecx, edi
call fcn.00429640
add esp, 4
mov ecx, eax
call fcn.00428aa0
mov byte [esp + 0x6d8], 0x29
cmp dword [0x4a1a34], 2
jl 0x4035a2
lea ecx, [esp + 0x84]
call fcn.0041de50
mov byte [esp + 0x6d8], 0x2a
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 2
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x40356c
add eax, 0x10
jmp 0x40356e
xor eax, eax
lea ecx, [esp + 0x8c]
push ecx
push ecx
push str.ActionProcessor::Process:_CreateDirectory
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 8
lea ecx, [esp + 0x84]
mov byte [esp + 0x6d8], 0x29
call fcn.0041dee0
lea ecx, [esp + 0x8c]
call fcn.004156d0
lea ecx, [esp + 0x8c]
test al, al
je 0x40362a
call fcn.00413e80
test al, al
jne 0x403637
cmp dword [0x4a1a34], 1
jl 0x403637
lea ecx, [esp + 0x1c]
call fcn.0041de50
mov byte [esp + 0x6d8], 0x2b
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 1
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x4035f5
add eax, 0x10
jmp 0x4035f7
xor eax, eax
lea ecx, [esp + 0x8c]
push ecx
push ecx
push str.ActionProcessor::Process___unable_to_set_directory_permissions_for:
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 8
lea ecx, [esp + 0x1c]
mov byte [esp + 0x6d8], 0x29
call fcn.0041dee0
jmp 0x403637
call fcn.00414000
test al, al
je 0x403b68
mov esi, dword [ebx]
push 0
push ecx
push str.ActionId
mov ecx, edi
call fcn.00429640
mov ecx, eax
call fcn.00428b90
add esp, 4
mov ecx, ebx
push eax
call dword [esi + 0xc]
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x8c]
mov byte [eax], 1
call fcn.00404080
cmp dword [esp + 0xb8], 0x10
jb 0x403684
push dword [esp + 0xa4]
call fcn.0043d98b
add esp, 4
lea ecx, [esp + 0x11c]
mov dword [esp + 0xb8], 0xf
mov dword [esp + 0xb4], 0
mov byte [esp + 0xa4], 0
mov dword [esp + 0x6d8], 0xffffffff
call fcn.00401a50
mov edi, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
inc edi
jmp 0x402716
cmp dword [0x4a1a34], 3
jl 0x403770
lea ecx, [esp + 0x1c]
call fcn.0041de50
mov byte [esp + 0x6d8], 0x12
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 3
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x4036fe
add eax, 0x10
jmp 0x403700
xor eax, eax
lea ecx, [esp + 0x644]
push ecx
push ecx
push 0x48d434
push ecx
lea ecx, [esp + 0x21c]
push ecx
push ecx
push str.__target:
push ecx
push dword [esp + 0x48]
push ecx
push str.ActionProcessor::Process:_dependencies_are_not_ready_for_action_index:
push eax
call fcn.00407740
add esp, 0xc
mov ecx, eax
call fcn.00404210
add esp, 4
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 0xc
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 8
lea ecx, [esp + 0x1c]
mov byte [esp + 0x6d8], 0xf
call fcn.0041dee0
lea ecx, [esp + 0x16c]
call fcn.004091b0
jmp 0x403eb8
push str.unable_to_execute
lea ecx, [esp + 0x90]
call fcn.00403fb0
lea ecx, [esp + 0x8c]
mov byte [esp + 0x6d8], 0x17
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 8]
mov byte [esp + 0x6d8], 0xf
cmp dword [esp + 0xa0], 0x10
jb 0x4037ca
push dword [esp + 0x8c]
call fcn.0043d98b
add esp, 4
cmp dword [0x4a1a34], 0
jl 0x4039f9
lea ecx, [esp + 0x1c]
call fcn.0041de50
mov byte [esp + 0x6d8], 0x18
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 0
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x403801
add eax, 0x10
jmp 0x403803
xor eax, eax
push str.__did_not_complete_successfully
push ecx
lea ecx, [esp + 0x64c]
push ecx
push ecx
push 0x48d434
push ecx
lea ecx, [esp + 0x224]
push ecx
push ecx
push str.ActionProcessor::Process:_Execution_attempt__
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 0xc
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 0xc
push eax
call fcn.00407740
lea ecx, [esp + 0x24]
jmp 0x4039e9
push str.unable_to_execute
lea ecx, [esp + 0x90]
call fcn.00403fb0
lea ecx, [esp + 0x8c]
mov byte [esp + 0x6d8], 0x14
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 8]
mov byte [esp + 0x6d8], 0xf
cmp dword [esp + 0xa0], 0x10
jb 0x4038a2
push dword [esp + 0x8c]
call fcn.0043d98b
add esp, 4
cmp dword [0x4a1a34], 0
jl 0x4039f9
lea ecx, [esp + 0x1c]
call fcn.0041de50
mov byte [esp + 0x6d8], 0x15
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 0
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x4038eb
add eax, 0x10
push str.ActionProcessor::Process:_Attempt_failed
push eax
call fcn.00407740
lea ecx, [esp + 0x24]
jmp 0x4039e9
xor eax, eax
push str.ActionProcessor::Process:_Attempt_failed
push eax
call fcn.00407740
lea ecx, [esp + 0x24]
jmp 0x4039e9
push 0x2d
push str.unable_to_run_execution____invalid_parameters
lea ecx, [esp + 0x94]
mov dword [esp + 0xa8], 0xf
mov dword [esp + 0xa4], 0
mov byte [esp + 0x94], 0
call fcn.00406350
lea ecx, [esp + 0x8c]
mov byte [esp + 0x6d8], 0x10
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 8]
mov byte [esp + 0x6d8], 0xf
cmp dword [esp + 0xa0], 0x10
jb 0x40396a
push dword [esp + 0x8c]
call fcn.0043d98b
add esp, 4
cmp dword [0x4a1a34], 0
jl 0x4039f9
mov dword [esp + 0xf4], vtable.Log.0
call fcn.0041ddc0
mov esi, eax
lea eax, [esp + 0xec]
push eax
mov dword [esp + 0xfc], esi
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [esp + 0xec]
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0xf0]
mov dword [esi + 0x14], ecx
call fcn.0042f280
mov dword [esi + 0x18], eax
mov byte [esp + 0x6d8], 0x11
mov dword [esi + 8], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4039d5
add eax, 0x10
jmp 0x4039d7
xor eax, eax
push str.ActionProcessor::Process:_unable_to_run_execution____invalid_parameters
push eax
call fcn.00407740
lea ecx, [esp + 0xfc]
add esp, 8
mov byte [esp + 0x6d8], 0xf
call fcn.0041dee0
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x16c]
mov byte [eax], 1
call fcn.004091b0
jmp 0x403eb8
cmp dword [esp + 0xe8], 0x10
mov eax, dword [esp + 0x24]
mov byte [eax], 1
jb 0x403a31
push dword [esp + 0xd4]
call fcn.0043d98b
add esp, 4
cmp dword [esp + 0xa0], 0x10
mov dword [esp + 0xe8], 0xf
mov dword [esp + 0xe4], 0
mov byte [esp + 0xd4], 0
jb 0x403eb8
push dword [esp + 0x8c]
call fcn.0043d98b
add esp, 4
jmp 0x403eb8
cmp dword [0x4a1a34], 3
jl 0x403af5
lea ecx, [esp + 0x1c]
call fcn.0041de50
mov byte [esp + 0x6d8], 0x1c
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 3
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x403aa4
add eax, 0x10
jmp 0x403aa6
xor eax, eax
lea ecx, [esp + 0x8c]
push ecx
push ecx
push str.__target:
push ecx
push dword [esp + 0x38]
push ecx
push str.ActionProcessor::Process:_dependencies_are_not_ready_for_action_index:
push eax
call fcn.00407740
add esp, 0xc
mov ecx, eax
call fcn.00404210
add esp, 4
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 8
lea ecx, [esp + 0x1c]
mov byte [esp + 0x6d8], 0x1b
call fcn.0041dee0
cmp dword [esp + 0xe8], 0x10
jb 0x403b0e
push dword [esp + 0xd4]
call fcn.0043d98b
add esp, 4
cmp dword [esp + 0xa0], 0x10
mov dword [esp + 0xe8], 0xf
mov dword [esp + 0xe4], 0
mov byte [esp + 0xd4], 0
jb 0x403b45
push dword [esp + 0x8c]
call fcn.0043d98b
add esp, 4
mov dword [esp + 0xa0], 0xf
mov dword [esp + 0x9c], 0
mov byte [esp + 0x8c], 0
jmp 0x403eb8
cmp dword [0x4a1a34], 1
jl 0x403bce
lea ecx, [esp + 0x1c]
call fcn.0041de50
mov byte [esp + 0x6d8], 0x2c
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 1
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x403b9b
add eax, 0x10
jmp 0x403b9d
xor eax, eax
lea ecx, [esp + 0x8c]
push ecx
push ecx
push str.ActionProcessor::Process___failed_to_create_directory:
push eax
call fcn.00407740
add esp, 0xc
push eax
call fcn.004079f0
add esp, 8
lea ecx, [esp + 0x1c]
mov byte [esp + 0x6d8], 0x29
call fcn.0041dee0
lea ecx, [esp + 0x8c]
call fcn.00404080
lea ecx, [esp + 0xa4]
call fcn.00404080
jmp 0x403eef
cmp dword [0x4a1a34], 2
jl 0x403c3f
lea ecx, [esp + 0x1c]
call fcn.0041de50
mov byte [esp + 0x6d8], 0x28
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 2
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x403c1e
add eax, 0x10
jmp 0x403c20
xor eax, eax
push str.ActionProcessor::Process:_Shutdown_found__breaking
push eax
call fcn.00407740
add esp, 8
lea ecx, [esp + 0x1c]
mov byte [esp + 0x6d8], 8
call fcn.0041dee0
mov eax, dword [esp + 0x38]
jmp 0x403eb5
push str.Keys
mov ecx, edi
call fcn.00429640
cmp eax, 0x4a34c0
je 0x403e1c
push str.Keys
mov ecx, edi
call fcn.00429640
mov esi, eax
push str.Unforced
mov ecx, esi
call fcn.00429640
mov edi, dword [esp + 0x24]
cmp eax, 0x4a34c0
je 0x403cc1
push edi
push ecx
push str.Unforced
mov ecx, esi
call fcn.00429640
xor edx, edx
mov ecx, eax
call fcn.004023a0
add esp, 8
cmp byte [edi], 0
je 0x403cc1
push str.unable_to_set_unforced_reg_keys
lea ecx, [esp + 0xc0]
call fcn.00403fb0
mov byte [esp + 0x6d8], 0x1f
jmp 0x403d5f
push str.Forced32
mov ecx, esi
call fcn.00429640
cmp eax, 0x4a34c0
je 0x403d11
push edi
push ecx
push str.Forced32
mov ecx, esi
call fcn.00429640
mov edx, 1
mov ecx, eax
call fcn.004023a0
add esp, 8
cmp byte [edi], 0
je 0x403d11
push str.unable_to_set_forced32_reg_keys
lea ecx, [esp + 0xc0]
call fcn.00403fb0
mov byte [esp + 0x6d8], 0x20
jmp 0x403d5f
push str.Forced64
mov ecx, esi
call fcn.00429640
cmp eax, 0x4a34c0
je 0x403d7f
push edi
push ecx
push str.Forced64
mov ecx, esi
call fcn.00429640
mov edx, 2
mov ecx, eax
call fcn.004023a0
add esp, 8
cmp byte [edi], 0
je 0x403d7f
push str.unable_to_set_forced64_reg_keys
lea ecx, [esp + 0xc0]
call fcn.00403fb0
mov byte [esp + 0x6d8], 0x21
mov eax, dword [ebx]
lea ecx, [esp + 0xbc]
push ecx
mov ecx, ebx
call dword [eax + 8]
lea ecx, [esp + 0xbc]
call fcn.00404080
jmp 0x403eb8
cmp dword [0x4a1a34], 0
jl 0x403dd3
lea ecx, [esp + 0x1c]
call fcn.0041de50
mov byte [esp + 0x6d8], 0x22
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 0
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x403db2
add eax, 0x10
jmp 0x403db4
xor eax, eax
push str.ActionProcessor::Process:_SetRegKey_failed__illegal_key_found_
push eax
call fcn.00407740
add esp, 8
lea ecx, [esp + 0x1c]
mov byte [esp + 0x6d8], 8
call fcn.0041dee0
push str.unable_to_set_reg_keys__illegal_key_other_than_Unforced__Forced32__Forced64_
lea ecx, [esp + 0xc0]
call fcn.00403fb0
lea ecx, [esp + 0xbc]
mov byte [esp + 0x6d8], 0x23
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 8]
cmp dword [esp + 0xd0], 0x10
jb 0x403e14
push dword [esp + 0xbc]
call fcn.0043d98b
add esp, 4
mov byte [edi], 1
jmp 0x403eb8
cmp dword [0x4a1a34], 0
jl 0x403e70
lea ecx, [esp + 0x1c]
call fcn.0041de50
mov byte [esp + 0x6d8], 0x24
mov ecx, dword [eax + 4]
mov dword [ecx + 8], 0
mov eax, dword [eax + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x403e4f
add eax, 0x10
jmp 0x403e51
xor eax, eax
push str.ActionProcessor::Process:_SetRegKey_failed__missing_Values_section
push eax
call fcn.00407740
add esp, 8
lea ecx, [esp + 0x1c]
mov byte [esp + 0x6d8], 8
call fcn.0041dee0
push str.unable_to_set_reg_keys
lea ecx, [esp + 0xc0]
call fcn.00403fb0
lea ecx, [esp + 0xbc]
mov byte [esp + 0x6d8], 0x25
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 8]
cmp dword [esp + 0xd0], 0x10
jb 0x403eb1
push dword [esp + 0xbc]
call fcn.0043d98b
add esp, 4
mov eax, dword [esp + 0x24]
mov byte [eax], 1
cmp dword [esp + 0xb8], 0x10
jb 0x403ed1
push dword [esp + 0xa4]
call fcn.0043d98b
add esp, 4
mov byte [esp + 0xa4], 0
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb8], 0xf
lea ecx, [esp + 0x11c]
call fcn.00401a50
mov ecx, dword [esp + 0x6d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6b8]
xor ecx, esp
call fcn.0043cee8
mov esp, ebp
pop ebp
ret 0x10