Function at 0x4296e0
Capabilities:
Create directory
Delete file
Encode data using base64

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xa44
push ebx
xor ebx, ebx
cmp dword [0x4c0e60], ebx
push esi
push edi
mov dword [ebp + 0x60], ecx
mov dword [ebp + 0x28], ebx
jne 0x429716
mov esi, 0x4c0f90
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.0040eb0d
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp + 0x60]
lea ecx, [ebp - 0x7c]
call fcn.0040fef3
push 0x104
lea eax, [ebp - 0x9d0]
push eax
push 0x2711
push dword [0x4c0ea0]
mov dword [ebp - 0xd8], ebx
call fcn.00438590
add esp, 0x10
push 0x4abe98
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xa8], ebx
call fcn.00446497
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0xe4], ebx
call fcn.0043dd7e
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xac], 0x80000000
call fcn.0043dd7e
lea ecx, [ebp - 0xcc]
call fcn.0043dd7e
lea eax, [ebp - 0xe4]
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xf8], eax
lea eax, [ebp - 0x9c]
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0x6c], eax
call fcn.0043aaf4
shrd eax, edx, 0x10
shr edx, 0x10
mov edx, 0x60000
cmp eax, edx
sbb cl, cl
inc cl
cmp eax, edx
mov dword [ebp - 0xec], eax
mov byte [ebp + 0x47], cl
jb 0x4297ef
cmp eax, 0x6ffff
mov byte [ebp + 0x57], 1
jbe 0x4297f2
mov byte [ebp + 0x57], bl
lea ecx, [ebp + 0x4c]
mov byte [ebp + 0x3b], bl
call fcn.0043dd7e
push 7
pop ecx
xor eax, eax
mov esi, str._SystemRoot__
lea edi, [ebp - 0x124]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x60]
lea edi, [ebp - 0x108]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 1
stosd dword es:[edi], eax
push ebx
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.0044bafc
push dword [ebp + 0x4c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0xb4], eax
add eax, 0x1e
push eax
lea ecx, [ebp + 0x4c]
call fcn.0043ddc3
cmp byte [ebp + 0x57], bl
jl 0x429881
push dword [ebp + 0x4c]
lea ecx, [ebp - 0x14]
call fcn.00446497
push 0x4abe50
lea ecx, [ebp - 0x14]
call fcn.0043ddea
push dword [ebp - 0x14]
call fcn.00492742
neg eax
sbb al, al
pop ecx
lea ecx, [ebp - 0x14]
and eax, 3
mov byte [ebp + 0x57], al
call fcn.00437e1a
push 0x400032
lea ecx, [ebp - 0x38]
mov dword [ebp + 0x2c], 1
mov byte [ebp + 0x5d], bl
call fcn.0043dc74
push 0xa
push 0x4abe44
push dword [ebp - 0x38]
call fcn.004128b6
mov eax, dword [ebp - 0x38]
mov dword [eax + 0xa], ebx
mov eax, dword [ebp - 0x38]
mov dword [eax + 0xe], ebx
mov esi, dword [ebp - 0x38]
add esp, 0xc
add esi, 0x12
mov dword [ebp - 4], esi
cmp byte [ebp + 0x5d], 0xff
jae 0x4298c8
inc byte [ebp + 0x5d]
push dword [ebp + 0x7c]
lea ecx, [ebp - 0xa8]
mov byte [ebp + 0x3a], bl
call fcn.0044655b
mov eax, dword [ebp - 0xa8]
lea ecx, [ebp + 0x70]
mov dword [ebp + 0x70], eax
mov byte [ebp + 0x6a], bl
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x68], ebx
mov byte [ebp + 0x1b], 2
mov byte [ebp + 0x39], bl
call fcn.0040e2c3
push 8
push dword [ebp + 0x70]
mov byte [ebp + 0x38], bl
push str.listdev:
mov byte [ebp + 0x56], 2
mov dword [ebp + 0x6c], ebx
mov byte [ebp + 0x69], 0xf0
mov byte [ebp - 0x4c], bl
mov byte [ebp - 0x47], bl
mov dword [ebp + 0x64], ebx
mov dword [ebp + 4], ebx
call fcn.0043917b
add esp, 0xc
test al, al
je 0x429982
add dword [ebp + 0x70], 0x10
mov eax, dword [ebp + 0x70]
movzx eax, word [eax]
cmp ax, bx
mov dword [ebp + 0x6c], 0x100
je 0x42994f
call fcn.00437e2d
test al, al
jne 0x42994f
mov eax, dword [ebp + 0x70]
mov dword [ebp + 4], eax
lea eax, [ebp + 0x70]
push eax
call fcn.00405172
mov eax, dword [ebp + 0x70]
cmp word [eax], bx
pop ecx
je 0x429968
mov word [eax], bx
add dword [ebp + 0x70], 2
lea ecx, [ebp + 0x70]
call fcn.0040e2c3
mov eax, dword [ebp + 4]
cmp word [eax], bx
jne 0x42999d
mov ebx, 0x80070057
jmp 0x42bccf
push 0xa
lea eax, [ebp + 0x70]
push eax
push str.buildcache:
call fcn.0043fca8
add esp, 0xc
test al, al
jne 0x42b4a0
mov al, byte [ebp + 0x57]
xor edi, edi
cmp dword [ebp - 0xec], 0x60000
mov byte [ebp + 0x6b], 0xff
mov byte [ebp + 0x5e], bl
mov dword [ebp + 0x58], edi
mov word [ebp - 0x50], bx
mov byte [ebp - 0x44], bl
mov byte [ebp - 0x1c], al
jb 0x4299c6
mov byte [ebp - 0x1c], 3
mov eax, dword [ebp + 0x70]
cmp word [eax], 0x2a
jne 0x42a12d
push 8
lea eax, [ebp + 0x70]
push eax
push str.extract
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x4299fb
mov byte [ebp - 0x4c], 1
mov byte [ebp + 0x56], 1
mov byte [ebp + 0x3a], 1
jmp 0x42a11d
push 4
lea eax, [ebp + 0x70]
push eax
push str.cab
call fcn.0043fbfd
add esp, 0xc
test al, al
jne 0x4299f2
push 8
lea eax, [ebp + 0x70]
push eax
push str.nocheck
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429a32
mov byte [ebp - 0x47], 1
jmp 0x42a11d
push 7
lea eax, [ebp + 0x70]
push eax
push str.devcon
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429a52
mov byte [ebp - 0x46], 1
jmp 0x42a11d
push 7
lea eax, [ebp + 0x70]
push eax
push str.rescan
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429a71
mov byte [ebp + 0x69], bl
jmp 0x42a11d
push 9
lea eax, [ebp + 0x70]
push eax
push str.norescan
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429a91
mov byte [ebp + 0x69], 0xc0
jmp 0x42a11d
push 8
push dword [ebp + 0x70]
push str.rescan:
call fcn.0043917b
add esp, 0xc
test al, al
je 0x429ad1
movsx eax, byte [ebp + 0x69]
add dword [ebp + 0x70], 0x10
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 0x70]
push eax
call fcn.0043a784
mov al, byte [ebp + 0xc]
cmp al, bl
pop ecx
pop ecx
mov byte [ebp + 0x69], al
jge 0x42a11d
jmp 0x429a69
push 6
lea eax, [ebp + 0x70]
push eax
push str.dummy
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429af1
mov byte [ebp - 0x45], 1
jmp 0x42a11d
push 4
lea eax, [ebp + 0x70]
push eax
push str.sub
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429b11
mov byte [ebp + 0x38], 1
jmp 0x42a11d
push 5
lea eax, [ebp + 0x70]
push eax
push str.self
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429b31
mov byte [ebp + 0x38], 2
jmp 0x42a11d
push 4
lea eax, [ebp + 0x70]
push eax
push str.7pe
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429b51
mov byte [ebp - 0x1c], 3
jmp 0x42a11d
push 4
lea eax, [ebp + 0x70]
push eax
push str.7pe_
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429b73
mov al, byte [ebp + 0x57]
mov byte [ebp - 0x1c], al
jmp 0x42a11d
push 8
lea eax, [ebp + 0x70]
push eax
push str.drvload
call fcn.0043fbfd
add esp, 0xc
test al, al
jne 0x429b68
push 6
lea eax, [ebp + 0x70]
push eax
push str.inner
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429baa
mov byte [ebp - 0x1c], 0xc0
jmp 0x42a11d
push 9
lea eax, [ebp + 0x70]
push eax
push str.nnverify
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429bca
mov byte [ebp + 0x56], 1
jmp 0x42a11d
push 8
lea eax, [ebp + 0x70]
push eax
push str.rverify
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429be9
mov byte [ebp + 0x56], bl
jmp 0x42a11d
push 0xa
lea eax, [ebp + 0x70]
push eax
push str.listdevi
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429c13
mov eax, dword [ebp + 0x6c]
and eax, 0xff00
or eax, 2
mov dword [ebp + 0x6c], eax
jmp 0x42a11d
push 0xa
lea eax, [ebp + 0x70]
push eax
push str.listdevc
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429c37
mov eax, dword [ebp + 0x6c]
and eax, 0xff00
or eax, 4
jmp 0x429c0b
push 0xa
lea eax, [ebp + 0x70]
push eax
push str.listdev
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429c5b
mov eax, dword [ebp + 0x6c]
and eax, 0xff00
or eax, 8
jmp 0x429c0b
push 6
lea eax, [ebp + 0x70]
push eax
push str.comp
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429c7b
mov byte [ebp + 0x5e], 1
jmp 0x42a11d
push 5
lea eax, [ebp + 0x70]
push eax
push str.hwid
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429c9b
or byte [ebp + 0x6d], 0x10
jmp 0x42a11d
push 5
lea eax, [ebp + 0x70]
push eax
push 0x4abd54
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429cbb
or byte [ebp + 0x6d], 8
jmp 0x42a11d
push 5
lea eax, [ebp + 0x70]
push eax
push str.inst
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429cdb
or byte [ebp + 0x6d], 0x20
jmp 0x42a11d
push 4
lea eax, [ebp + 0x70]
push eax
push str.All
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429cfb
or byte [ebp + 0x6d], 2
jmp 0x42a11d
push 5
lea eax, [ebp + 0x70]
push eax
push 0x4abd3c
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429d1b
or byte [ebp + 0x6d], 4
jmp 0x42a11d
push 5
lea eax, [ebp + 0x70]
push eax
push str.auto
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429d3d
mov word [ebp - 0x50], 3
jmp 0x42a11d
push 4
lea eax, [ebp + 0x70]
push eax
push str.sys
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429d5d
mov byte [ebp - 0x44], 1
jmp 0x42a11d
mov eax, dword [str.disverify]
push 0xa
lea ecx, [ebp + 0x70]
inc eax
push ecx
push eax
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429d7f
or byte [ebp + 0x6a], 1
jmp 0x42a11d
push 0xb
lea eax, [ebp + 0x70]
push eax
push dword [0x4bf2e4]
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429da0
or byte [ebp + 0x6a], 3
jmp 0x42a11d
push 0xe
lea eax, [ebp + 0x70]
push eax
push dword [0x4bf2e0]
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x429dc1
or byte [ebp + 0x6a], 0x10
jmp 0x42a11d
push 7
lea eax, [ebp + 0x70]
push eax
push str.sysdir:
call fcn.0043fca8
add esp, 0xc
test al, al
je 0x429df8
mov eax, dword [ebp + 0x70]
push 0x1cd
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.00419202
add esp, 0xc
mov dword [ebp + 0x70], eax
jmp 0x42a11d
push 4
lea eax, [ebp + 0x70]
push eax
push str.ret:
call fcn.0043fca8
add esp, 0xc
test al, al
je 0x429e5a
mov ecx, dword [ebp + 0x70]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x429e34
call fcn.00437e2d
test al, al
jne 0x429e34
lea eax, [ebp - 0xe0]
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x70]
push eax
call fcn.00405172
mov eax, dword [ebp + 0x70]
cmp word [eax], bx
pop ecx
je 0x429e4d
mov word [eax], bx
add dword [ebp + 0x70], 2
lea ecx, [ebp + 0x70]
call fcn.0040e2c3
jmp 0x42a11d
push 6
lea eax, [ebp + 0x70]
push eax
push str.IdCah:
call fcn.0043fca8
add esp, 0xc
test al, al
je 0x429ebf
mov ecx, dword [ebp + 0x70]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x429e8a
call fcn.00437e2d
test al, al
jne 0x429e8a
mov dword [ebp + 0x28], ecx
lea eax, [ebp + 0x70]
push eax
call fcn.00405172
mov eax, dword [ebp + 0x70]
cmp word [eax], bx
pop ecx
je 0x429ea3
mov word [eax], bx
add dword [ebp + 0x70], 2
lea ecx, [ebp + 0x70]
call fcn.0040e2c3
mov eax, dword [ebp + 0x28]
cmp word [eax], bx
jne 0x42a11d
mov dword [ebp + 0x28], ebx
jmp 0x42a11d
push 6
lea eax, [ebp + 0x70]
push eax
push str.retid:
call fcn.0043fca8
add esp, 0xc
test al, al
je 0x429f08
mov ecx, dword [ebp + 0x70]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x429e34
call fcn.00437e2d
test al, al
jne 0x429e34
lea eax, [ebp - 0x9c]
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0x6c], eax
jmp 0x429e34
push 0xa
push dword [ebp + 0x70]
push str.DevClass:
call fcn.0043917b
add esp, 0xc
test al, al
je 0x429f4a
mov ecx, dword [ebp + 0x70]
add ecx, 0x14
xor eax, eax
mov dword [ebp + 0x70], ecx
mov ax, word [ecx]
cmp ax, bx
je 0x429e34
call fcn.00437e2d
test al, al
jne 0x429e34
mov dword [ebp - 0x68], ecx
jmp 0x429e34
push 7
push dword [ebp + 0x70]
push str.DevID:
call fcn.0043917b
add esp, 0xc
test al, al
je 0x429fdd
mov ecx, dword [ebp + 0x70]
add ecx, 0xe
xor eax, eax
mov dword [ebp + 0x70], ecx
mov ax, word [ecx]
cmp ax, bx
je 0x429f7f
call fcn.00437e2d
test al, al
jne 0x429f7f
mov dword [ebp + 0x64], ecx
lea eax, [ebp + 0x70]
push 0x27
push eax
call fcn.00412c53
mov eax, dword [ebp + 0x70]
cmp word [eax], bx
pop ecx
pop ecx
je 0x429f9b
mov word [eax], bx
add dword [ebp + 0x70], 2
lea ecx, [ebp + 0x70]
call fcn.0040e2c3
cmp dword [ebp + 0x64], ebx
je 0x42a11d
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
jle 0x429fd5
mov ecx, dword [ebp + 0x64]
cmp word [ecx + eax*2 - 2], 0x26
jne 0x429fcd
mov word [ecx + eax*2], bx
dec eax
cmp eax, ebx
jg 0x429fbc
cmp eax, ebx
jg 0x42a11d
mov dword [ebp + 0x64], ebx
jmp 0x42a11d
push 0xa
lea eax, [ebp + 0x70]
push eax
push str.infcache:
call fcn.0043fce8
add esp, 0xc
test al, al
je 0x42a01d
mov ecx, dword [ebp + 0x70]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
je 0x42a0e5
call fcn.00437e2d
test al, al
jne 0x42a0e5
mov dword [ebp - 0xd8], ecx
jmp 0x42a0e5
push 9
push dword [ebp + 0x70]
push str.disable:
call fcn.0043917b
add esp, 0xc
test al, al
je 0x42a03c
mov byte [ebp + 0x6b], 2
jmp 0x42a0c6
push 8
push dword [ebp + 0x70]
push str.enable:
call fcn.0043917b
add esp, 0xc
test al, al
je 0x42a058
mov byte [ebp + 0x6b], 1
jmp 0x42a0ca
push 8
push dword [ebp + 0x70]
push str.remove:
call fcn.0043917b
add esp, 0xc
test al, al
je 0x42a074
mov byte [ebp + 0x6b], 5
jmp 0x42a0ca
push 8
push dword [ebp + 0x70]
push str.update:
call fcn.0043917b
add esp, 0xc
test al, al
je 0x42a090
mov byte [ebp + 0x6b], 0x11
jmp 0x42a0ca
push 8
push dword [ebp + 0x70]
push str.status:
call fcn.0043917b
add esp, 0xc
test al, al
je 0x42a0ac
mov byte [ebp + 0x6b], 0x12
jmp 0x42a0ca
push 9
push dword [ebp + 0x70]
push str.restart:
call fcn.0043917b
add esp, 0xc
test al, al
je 0x42a0f6
mov byte [ebp + 0x6b], 3
add dword [ebp + 0x70], 2
add dword [ebp + 0x70], 0x10
mov eax, dword [ebp + 0x70]
movzx eax, word [eax]
cmp ax, bx
je 0x42a0e5
call fcn.00437e2d
test al, al
jne 0x42a0e5
mov edi, dword [ebp + 0x70]
lea eax, [ebp + 0x70]
push 0x27
push eax
call fcn.00412c53
pop ecx
jmp 0x429e3d
push 3
lea eax, [ebp + 0x70]
push eax
push 0x4abc9c
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x42a113
mov byte [ebp + 0x39], 1
jmp 0x42a11d
lea eax, [ebp + 0x70]
push eax
call fcn.00405196
pop ecx
mov eax, dword [ebp + 0x70]
cmp word [eax], 0x2a
je 0x4299d3
mov dword [ebp + 0x58], edi
cmp byte [ebp + 0x69], 0xf0
mov ecx, dword [ebp + 0x6c]
setl byte [ebp - 0x1d]
shr ecx, 8
and cl, 1
mov byte [ebp + 0x5f], cl
je 0x42a146
mov byte [ebp - 0x4c], bl
cmp dword [ebp + 0x6c], ebx
je 0x42a152
cmp cl, bl
jne 0x42a152
mov byte [ebp + 0x5e], bl
mov eax, 0x2000
test dword [ebp + 0x6c], eax
je 0x42a166
test byte [ebp + 0x6d], 4
je 0x42a166
and byte [ebp + 0x6d], 0xfb
cmp cl, bl
je 0x42a17e
test byte [ebp + 0x6c], 2
je 0x42a17e
test byte [ebp + 0x6d], 0x3c
jne 0x42a17e
cmp byte [ebp + 0x5e], bl
jne 0x42a17e
or dword [ebp + 0x6c], eax
cmp cl, bl
mov dword [ebp - 0xe8], str.__DEVI.REBOOT
je 0x42a195
cmp dword [ebp + 4], ebx
je 0x42b4f7
cmp byte [ebp + 0x6b], bl
jge 0x42b503
cmp byte [ebp + 0x6a], bl
jne 0x42b6ee
cmp byte [ebp - 0x1c], bl
setl al
dec al
and eax, dword [ebp - 0x1c]
or byte [ebp + 0x47], al
cmp cl, bl
mov byte [ebp - 0x48], al
jne 0x42a1cb
cmp byte [ebp + 0x5d], 1
jne 0x42a1cb
mov eax, dword [ebp + 0x60]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp + 0x64]
push 0x20
mov dword [ebp - 0xc0], eax
lea eax, [esi + 0x400000]
push ebx
push eax
mov dword [esi], ebx
call fcn.00492e00
add esp, 0xc
xor edi, edi
cmp dword [ebp + 0x28], ebx
je 0x42a258
push 0x4c1b94
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 0x60]
push ebx
push 0xffffffffffffffff
push ebx
push dword [ebp + 0x28]
call fcn.0040f3c5
mov esi, eax
cmp esi, ebx
je 0x42a24a
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x42a24a
cmp dword [esi + 0x10], 0x400032
jb 0x42a24a
push 0xa
push eax
push 0x4abe44
call fcn.00437f1d
add esp, 0xc
test eax, eax
jne 0x42a24a
mov edi, dword [esi + 4]
push 0x400020
add edi, 0x12
push edi
push dword [ebp - 4]
call fcn.004128b6
add esp, 0xc
push 0x4c1b94
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 4]
cmp edi, ebx
sete byte [ebp + 0x6a]
xor eax, eax
mov dword [ebp - 0x118], 0x1c
mov dword [ebp - 0x114], ebx
lea edi, [ebp - 0x110]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x70]
xor ecx, ecx
mov dword [ebp - 0x7c], esi
cmp word [eax], 0x24
mov dword [ebp + 0x20], ebx
sete cl
cmp ecx, ebx
mov dword [ebp + 0x58], ecx
je 0x42a2a4
jmp 0x42a299
inc dword [ebp + 0x20]
inc eax
inc eax
mov dword [ebp + 0x70], eax
cmp word [eax], 0x24
je 0x42a296
lea ecx, [ebp + 0x70]
call fcn.0040e2c3
mov edi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x2c
push dword [ebp + 0x70]
call edi
xor esi, esi
cmp eax, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp + 0x1c], esi
mov dword [ebp + 0x3c], ebx
je 0x42a304
mov word [eax], bx
inc eax
inc eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], eax
call fcn.0040e2c3
push 0x2c
push dword [ebp - 0x18]
call edi
mov esi, eax
cmp esi, ebx
mov dword [ebp + 0x1c], esi
je 0x42a2fb
mov word [esi], bx
inc esi
inc esi
lea ecx, [ebp + 0x1c]
mov dword [ebp + 0x1c], esi
call fcn.0040e2c3
mov esi, dword [ebp + 0x1c]
push dword [ebp - 0x18]
call fcn.0040f54c
pop ecx
push dword [ebp + 0x70]
call fcn.0040f54c
cmp esi, ebx
pop ecx
je 0x42a33d
push 0x2c
push esi
call edi
cmp eax, ebx
mov dword [ebp + 0x3c], eax
je 0x42a336
mov word [eax], bx
inc eax
inc eax
lea ecx, [ebp + 0x3c]
mov dword [ebp + 0x3c], eax
call fcn.0040e2c3
push dword [ebp + 0x3c]
call fcn.0040f54c
pop ecx
push esi
call fcn.0040f54c
pop ecx
mov eax, dword [ebp + 0x70]
cmp word [eax], bx
je 0x42a3f4
lea eax, [ebp + 0x70]
push 1
push eax
call fcn.00444a3a
cmp eax, ebx
pop ecx
pop ecx
je 0x42a3f4
cmp word [eax], 0x23
jne 0x42a3f4
lea ecx, [ebp - 0xa0]
call fcn.0043dd7e
push str..tmp.cab
push str.devi
push ebx
lea eax, [ebp - 0xa0]
push eax
push ebx
call fcn.0040556e
add esp, 0x14
push str.__dd__len16M___
lea ecx, [ebp + 0x14]
call fcn.00446497
push dword [ebp - 0xa0]
lea ecx, [ebp + 0x14]
call fcn.0043ddea
push 0x4abc2c
lea ecx, [ebp + 0x14]
call fcn.0043ddea
push dword [ebp + 0x70]
lea ecx, [ebp + 0x14]
call fcn.0043ddea
mov ecx, dword [ebp + 0x60]
push ebx
push dword [ebp + 0x14]
call fcn.00468de9
push dword [ebp - 0xa0]
lea ecx, [ebp - 0xcc]
call fcn.004100ca
lea ecx, [ebp + 0x14]
mov dword [ebp + 0x70], eax
call fcn.00437e1a
lea ecx, [ebp - 0xa0]
call fcn.00437e1a
push dword [ebp + 0x70]
call fcn.004925aa
pop ecx
push dword [ebp + 0x70]
mov dword [ebp - 0xb8], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp byte [ebp + 0x3a], bl
mov edi, eax
jne 0x42a43f
cmp dword [ebp - 0xb8], ebx
jne 0x42a437
cmp edi, 4
jle 0x42a437
mov eax, dword [ebp + 0x70]
lea eax, [eax + edi*2 - 8]
push str..CAB
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x42a43f
mov dword [ebp + 0xc], ebx
jmp 0x42a4db
cmp byte [0x4c0be5], 1
mov dword [ebp + 0xc], 1
mov eax, str.SysWow64
je 0x42a459
mov eax, str.System32
mov ecx, dword [ebp - 0xb4]
push 0x10
push eax
mov eax, dword [ebp + 0x4c]
lea eax, [eax + ecx*2]
push eax
call fcn.004128b6
mov eax, dword [ebp + 0x4c]
mov ecx, dword [ebp - 0xb4]
push 0x1a
lea eax, [eax + ecx*2 + 0x10]
push str.cabinet.dll
push eax
call fcn.004128b6
add esp, 0x18
cmp byte [ebp + 0x5f], bl
jne 0x42a4db
push dword [ebp + 0x4c]
call fcn.00492742
test eax, eax
pop ecx
jne 0x42a4db
push 0x63
lea ecx, [ebp - 0xc8]
call fcn.0043dd9c
push dword [ebp + 0x4c]
push str.__dd__bs1M__s_0__._33INDATA
push dword [ebp - 0xc8]
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp + 0x60]
add esp, 0xc
push ebx
push dword [ebp - 0xc8]
call fcn.00468de9
lea ecx, [ebp - 0xc8]
call fcn.00437e1a
cmp esi, ebx
je 0x42a4ea
cmp word [esi], 0x2a
jne 0x42a4ea
xor esi, esi
mov dword [ebp + 0x1c], esi
cmp edi, 4
jle 0x42a50d
mov eax, dword [ebp + 0x70]
lea eax, [eax + edi*2 - 8]
push 0x4aaaf8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x42a50d
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x42a512
xor ecx, ecx
xor eax, eax
inc ecx
cmp dword [ebp - 0xb8], ebx
jne 0x42a521
cmp eax, ebx
mov dword [ebp + 0x34], ecx
jne 0x42a524
mov dword [ebp + 0x34], ebx
cmp dword [ebp + 0x20], ecx
je 0x42a544
cmp eax, ebx
je 0x42a536
cmp dword [ebp + 0x58], ebx
je 0x42a536
cmp esi, ebx
jne 0x42a544
cmp dword [ebp + 0x34], ebx
je 0x42a540
cmp dword [ebp + 0x58], ebx
jne 0x42a544
xor al, al
jmp 0x42a546
mov al, 1
cmp dword [ebp + 0x34], ebx
jne 0x42a552
cmp al, bl
mov dword [ebp + 0x20], ebx
je 0x42a555
mov dword [ebp + 0x20], ecx
cmp byte [ebp + 0x5f], bl
mov dword [ebp + 0x50], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov word [ebp - 0x4e], bx
jne 0x42a60b
cmp esi, ebx
je 0x42a60b
cmp word [esi], bx
je 0x42a60b
cmp dword [ebp + 0x20], ebx
jne 0x42a60b
push esi
lea ecx, [ebp + 0x50]
call fcn.0044655b
push dword [ebp + 0x50]
call fcn.00412d86
pop ecx
push ebx
push dword [ebp + 0x50]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x105
lea ecx, [ebp - 0xa4]
call fcn.0043dd9c
push 0x104
push dword [ebp - 0xa4]
push dword [ebp + 0x50]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov eax, dword [ebp - 0xa4]
cmp word [eax], bx
je 0x42a5dc
mov ecx, dword [ebp + 0x50]
mov dword [ebp + 0x50], eax
mov dword [ebp - 0xa4], ecx
push dword [ebp + 0x50]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esi + eax*2 - 2], 0x5c
je 0x42a5fa
push 0x4a754c
lea ecx, [ebp + 0x50]
call fcn.0043ddea
mov eax, dword [ebp + 0x50]
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x74], eax
call fcn.00437e1a
cmp dword [ebp + 0x58], ebx
jne 0x42a61a
cmp byte [ebp + 0x47], bl
je 0x42a635
cmp byte [ebp - 0x4c], bl
jne 0x42a635
cmp byte [ebp - 0x44], bl
jne 0x42a635
cmp byte [ebp + 0x5f], bl
jne 0x42a635
cmp byte [ebp + 0x56], 1
je 0x42a635
lea ecx, [ebp - 0xac]
call fcn.004100e4
cmp byte [ebp + 0x56], 2
jne 0x42a641
mov dword [ebp - 0xac], ebx
cmp dword [ebp + 0xc], ebx
je 0x42a672
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x42a672
or dword [ebp - 8], 0xffffffff
mov dword [ebp + 0x48], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0x48]
push eax
call fcn.004495af
mov eax, dword [ebp - 8]
cmp eax, ebx
pop ecx
pop ecx
jle 0x42a672
cmp eax, 0x14
jge 0x42a672
mov byte [ebp + 0x1b], al
cmp byte [ebp + 0x5d], 1
jne 0x42a6c6
cmp byte [ebp + 0x5f], bl
jne 0x42a6c6
cmp byte [ebp - 0x4c], bl
jne 0x42a6c6
movsx eax, byte [ebp + 0x69]
push eax
movsx eax, byte [ebp - 0x47]
push eax
push dword [ebp + 0x58]
movsx eax, byte [ebp - 0x48]
push dword [ebp + 0x34]
push eax
push dword [ebp - 0xec]
lea eax, [ebp - 0x4b4]
push str.Ver_lX_bNt6_d_bINF_d_bInstall_d_notcheck_d_rescan_d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x4b4]
push eax
push 0x4abb14
push dword [ebp + 0x60]
call fcn.0040f70e
add esp, 0x2c
cmp byte [ebp + 0x69], bl
jge 0x42a6fe
cmp dword [ebp + 0x6c], ebx
jne 0x42a79f
cmp byte [ebp + 0x69], 0xf0
jl 0x42a793
cmp byte [ebp - 0x48], bl
je 0x42a793
cmp dword [ebp + 0x34], ebx
jne 0x42a6f5
cmp dword [ebp + 0x58], ebx
je 0x42a793
cmp byte [ebp - 0x47], bl
jne 0x42a793
cmp byte [ebp + 0x5d], 1
jne 0x42a719
push 0x4a69d4
push 0x4abafc
push dword [ebp + 0x60]
call fcn.0040f70e
add esp, 0xc
mov ecx, dword [ebp + 0x60]
push ebx
push 0x11
push ebx
push str.rescan__BEGIN
call fcn.0041b06a
push ebx
push ebx
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.SETUPAPI.dll_CM_Locate_DevNodeW]
push ebx
push ebx
mov esi, 0x4c0fb8
push 0xa
mov ecx, esi
mov edi, eax
call fcn.00413b53
cmp edi, ebx
jne 0x42a76e
xor eax, eax
mov al, byte [ebp + 0x69]
and eax, 7
push eax
push dword [ebp - 8]
call dword [sym.imp.SETUPAPI.dll_CM_Reenumerate_DevNode]
push ebx
push ebx
push 5
mov ecx, esi
mov edi, eax
call fcn.00413b53
mov ecx, dword [ebp + 0x60]
push ebx
push ebx
push 0x32
mov dword [ebp + 0x2c], edi
call fcn.00413b53
mov ecx, dword [ebp + 0x60]
push ebx
push 0x11
push ebx
push str.rescan__END
call fcn.0041b06a
cmp dword [ebp + 0x6c], ebx
jne 0x42a79f
mov eax, dword [ebp + 0x70]
cmp word [eax], bx
je 0x42b704
lea ecx, [ebp + 0x24]
call fcn.0043dd7e
push dword [ebp + 0x70]
call fcn.0041161a
push ebx
lea ecx, [ebp + 0x24]
push ecx
push eax
mov dword [ebp + 0x70], eax
call fcn.00485e2a
mov dword [ebp + 0x70], eax
add esp, 0x10
xor eax, eax
cmp dword [ebp + 0x6c], ebx
je 0x42a7d3
test byte [ebp + 0x6d], 2
jne 0x42a7d3
push 2
pop eax
or eax, 4
push eax
push ebx
push ebx
push ebx
call dword [0x4c0e64]
cmp eax, 0xffffffff
mov dword [ebp - 0x30], eax
jne 0x42a7f4
cmp dword [ebp + 0x34], ebx
mov dword [ebp - 0x30], ebx
je 0x42b70c
lea ecx, [ebp + 0x40]
mov dword [ebp - 0x88], ebx
call fcn.0043dd7e
mov esi, dword [ebp + 0x6c]
and esi, 0xff
cmp dword [ebp + 0x64], ebx
mov dword [ebp - 8], esi
je 0x42a81c
push dword [ebp + 0x64]
call fcn.00412b97
pop ecx
mov eax, dword [ebp + 0x6c]
and eax, 0xffffff00
or eax, esi
cmp dword [ebp + 0x64], ebx
mov dword [ebp + 0x6c], eax
mov dword [ebp - 0x94], ebx
mov dword [ebp + 0x48], ebx
je 0x42a914
cmp byte [ebp + 0x5f], bl
je 0x42a914
mov edi, dword [ebp + 0x64]
xor eax, eax
mov ax, word [edi]
xor esi, esi
cmp ax, 0x22
je 0x42a85a
cmp ax, 0x27
jne 0x42a85f
mov esi, eax
add edi, 2
push edi
call fcn.00414cd8
cmp eax, ebx
pop ecx
jl 0x42a86f
mov dword [ebp - 0xc], eax
jmp 0x42a875
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
cmp eax, ebx
jl 0x42a885
lea eax, [edi + 4]
push eax
push edi
call fcn.004128de
pop ecx
pop ecx
cmp si, bx
je 0x42a906
jmp 0x42a893
inc edi
inc edi
cmp si, ax
je 0x42a89d
mov ax, word [edi]
cmp ax, bx
jne 0x42a88c
jmp 0x42a8a3
mov dword [ebp - 0x94], edi
xor eax, eax
mov ax, word [edi]
cmp ax, 0x22
je 0x42a8b4
cmp ax, 0x27
jne 0x42a8f0
inc edi
inc edi
push edi
mov esi, eax
call fcn.00414cd8
cmp eax, ebx
pop ecx
mov ecx, eax
jge 0x42a8c8
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
jne 0x42a8f0
cmp eax, ebx
jl 0x42a8e6
lea eax, [edi + 4]
push eax
push edi
call fcn.004128de
pop ecx
pop ecx
jmp 0x42a8e6
inc edi
inc edi
cmp si, ax
je 0x42a89d
mov ax, word [edi]
cmp ax, bx
jne 0x42a8df
jmp 0x42a8a3
mov ecx, dword [ebp - 0x94]
xor eax, eax
mov ax, word [ecx]
cmp ax, bx
mov dword [ebp + 0x48], eax
je 0x42a906
mov word [ecx], bx
mov eax, dword [ebp + 0x6c]
and eax, 0xffffff00
or eax, dword [ebp - 0xc]
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x6c]
xor ecx, ecx
and eax, 0x806
cmp eax, 0x802
sete cl
cmp eax, 0x800
mov esi, ecx
jne 0x42a939
cmp byte [ebp + 0x5e], bl
jne 0x42a939
xor edi, edi
inc edi
jmp 0x42a93b
xor edi, edi
mov eax, dword [ebp + 0x6c]
and eax, 0x1006
cmp eax, 0x1004
jne 0x42a954
cmp byte [ebp + 0x5e], bl
jne 0x42a954
xor eax, eax
inc eax
jmp 0x42a956
xor eax, eax
mov ecx, dword [ebp + 0x6c]
and ecx, 0x2002
sub ecx, 0x2000
neg ecx
sbb ecx, ecx
or eax, edi
inc ecx
neg eax
sbb eax, eax
test byte [ebp + 0x6c], 4
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0x84], eax
jne 0x42a990
cmp esi, ebx
mov dword [ebp - 0xd4], 1
je 0x42a99a
mov dword [ebp - 0xd4], 2
cmp dword [ebp + 0x64], ebx
je 0x42a9b0
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x8c], eax
jmp 0x42a9b6
mov dword [ebp - 0x8c], ebx
push 0x3f
xor eax, eax
pop ecx
mov word [ebp - 0x324], bx
lea edi, [ebp - 0x322]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x3f
xor eax, eax
cmp byte [ebp + 0x6a], bl
mov word [ebp - 0x224], bx
pop ecx
lea edi, [ebp - 0x222]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x118], 0x1c
je 0x42aecd
mov edi, dword [ebp - 4]
mov ecx, dword [ebp + 0x60]
push ebx
push 0x11
push ebx
add edi, 2
push str.DEVI_ID__BEGIN
mov dword [edi], ebx
call fcn.0041b06a
cmp byte [ebp - 0x4c], bl
jne 0x42adb3
cmp dword [ebp - 0x30], ebx
je 0x42adb3
mov dword [ebp - 0xc], ebx
mov eax, edi
sub eax, dword [ebp - 4]
cmp eax, 0x400000
jge 0x42adb3
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x30]
call dword [0x4c0e78]
test eax, eax
je 0x42adb3
cmp dword [ebp + 0x6c], ebx
je 0x42aa9a
cmp dword [ebp - 0x68], ebx
je 0x42aa90
push ebx
push 0x80
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x324], ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiClassNameFromGuidW]
push dword [ebp - 0x68]
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x42adab
test byte [ebp + 0x6c], 2
jne 0x42abb5
mov eax, dword [0x4c0e88]
cmp eax, ebx
mov dword [ebp - 0xf0], ebx
je 0x42aace
push ebx
push dword [ebp - 0x104]
lea ecx, [ebp - 0xf0]
push ecx
lea ecx, [ebp - 0x80]
push ecx
mov dword [ebp - 0x118], 0x1c
mov dword [ebp - 0x80], 0x400
call eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp + 0x34], eax
movsx eax, word [ebp - 0x84]
mov dword [ebp + 0x10], edi
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x80], 1
mov eax, dword [ebp - 4]
sub eax, edi
add eax, 0x3f0002
mov ecx, 0xfffe
cmp eax, ecx
mov dword [edi], ebx
jle 0x42ab05
mov eax, ecx
push ebx
push eax
lea esi, [edi + 0x1fffc]
push esi
push ebx
push dword [ebp + 0x34]
mov dword [ebp - 0x118], 0x1c
mov dword [esi + eax], ebx
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0x30]
mov dword [ebp - 0x24], esi
mov dword [esi], ebx
call dword [0x4c0e68]
cmp eax, ebx
mov dword [ebp - 0x118], 0x1c
je 0x42adab
cmp byte [ebp + 0x5f], bl
je 0x42ac9c
cmp dword [ebp + 0x64], ebx
je 0x42ac47
test dword [ebp + 0x6c], 2
jne 0x42ac47
cmp dword [ebp - 0x80], ebx
je 0x42ac47
push 0x100
push dword [ebp - 0x8c]
push esi
push dword [ebp + 0x64]
call fcn.00412a06
add esp, 0x10
test eax, eax
jne 0x42aba9
test byte [ebp + 0x6c], 8
je 0x42adab
cmp dword [ebp + 0x34], 2
je 0x42adab
mov dword [ebp + 0x34], 2
jmp 0x42aaee
cmp dword [ebp - 0xbc], ebx
je 0x42ac47
push ebx
push 0x80
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 0x30]
mov dword [ebp - 0x224], ebx
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdW]
cmp dword [ebp + 0x64], ebx
je 0x42abfe
cmp dword [ebp - 0xbc], ebx
jne 0x42abfe
push dword [ebp + 0x64]
lea eax, [ebp - 0x224]
push eax
call fcn.00412bec
test eax, eax
pop ecx
pop ecx
je 0x42adab
test byte [ebp + 0x6d], 4
jne 0x42ac0a
test byte [ebp + 0x6d], 0x20
jne 0x42ac16
cmp dword [ebp - 0xbc], ebx
je 0x42aa9a
cmp byte [ebp + 0x5f], bl
je 0x42aa9a
lea eax, [ebp - 0x224]
mov dword [ebp + 0x10], eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0x40]
push eax
call fcn.00412cc7
add esp, 0xc
jmp 0x42adab
mov esi, dword [ebp - 0x24]
cmp word [esi], bx
je 0x42ac71
cmp dword [ebp - 0x90], ebx
jl 0x42ac71
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x40]
push eax
call fcn.00412cc7
add esp, 0xc
test byte [ebp + 0x6d], 4
jne 0x42ac44
movsx eax, byte [ebp + 0x5e]
cmp dword [ebp - 0x90], eax
jge 0x42adab
inc dword [ebp - 0x90]
xor eax, eax
cmp dword [ebp + 0x34], 2
mov dword [ebp - 0x80], ebx
setne al
inc eax
mov dword [ebp + 0x34], eax
jmp 0x42aaee
push 4
push str.ACPI
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x42adab
cmp dword [ebp - 0x80], 1
jne 0x42accd
push esi
push dword [ebp - 0xc]
push dword [ebp - 0xc4]
push dword [ebp + 0x60]
call fcn.0040f70e
add esp, 0x10
xor eax, eax
mov ax, word [esi]
xor ecx, ecx
cmp ax, bx
mov dword [ebp - 0x28], ebx
je 0x42ad94
cmp ax, 0x26
jne 0x42acef
movsx eax, byte [ebp + 0x1b]
inc ecx
cmp ecx, eax
jge 0x42acff
inc dword [ebp - 0x28]
movzx eax, word [ebp - 0x28]
mov ax, word [esi + eax*2]
cmp ax, bx
jne 0x42ace0
cmp word [ebp - 0x28], bx
jbe 0x42ad94
mov eax, dword [ebp + 0x10]
jmp 0x42ad38
mov ax, word [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
cmp word [ecx - 2], ax
jne 0x42ad2d
movzx eax, ax
push eax
push esi
push ecx
call fcn.0040e1aa
add esp, 0xc
test al, al
jne 0x42ad84
mov eax, dword [ebp - 0x24]
movzx ecx, word [eax - 4]
lea eax, [eax + ecx*2 + 6]
cmp eax, edi
mov dword [ebp - 0x24], eax
jb 0x42ad0e
cmp esi, edi
mov eax, dword [ebp - 0x28]
mov ecx, edi
mov word [edi - 2], ax
jne 0x42ad68
movzx eax, ax
lea edi, [edi + eax*2]
jmp 0x42ad56
inc edi
inc edi
cmp word [edi], bx
jne 0x42ad54
mov esi, edi
jmp 0x42ad73
mov word [edi], ax
inc edi
inc edi
inc esi
inc esi
xor eax, eax
mov ax, word [esi]
cmp ax, bx
jne 0x42ad5f
mov word [edi], bx
mov eax, edi
sub eax, ecx
sar eax, 1
mov word [ecx - 4], ax
add edi, 6
jmp 0x42ad84
inc esi
inc esi
cmp word [esi], bx
jne 0x42ad82
inc esi
inc esi
cmp word [esi], bx
jne 0x42accd
cmp byte [ebp + 0x5e], bl
je 0x42ada5
push 2
pop eax
cmp dword [ebp + 0x34], eax
jne 0x42ac94
test byte [ebp + 0x6c], 2
jne 0x42add8
inc dword [ebp - 0xc]
jmp 0x42aa23
cmp byte [ebp + 0x5f], bl
je 0x42add8
mov ecx, dword [ebp + 0x48]
cmp cx, bx
je 0x42b718
mov eax, dword [ebp - 0x94]
mov esi, dword [ebp - 8]
mov word [eax], cx
mov dword [ebp + 0x64], eax
jmp 0x42a81c
cmp dword [ebp + 0x20], ebx
je 0x42adef
test byte [ebp + 0x6c], 2
je 0x42adef
mov dword [ebp - 0xd0], 1
jmp 0x42ae3c
cmp dword [ebp - 0xc0], ebx
mov dword [ebp - 0xd0], ebx
je 0x42ae3c
push dword [ebp - 0xc0]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, dword [ebp - 4]
mov edi, eax
mov word [esi], di
add esi, 2
lea eax, [edi + 1]
mov word [esi], di
push eax
push dword [ebp - 0xc0]
inc esi
inc esi
push esi
call fcn.0040515a
lea edi, [esi + edi*2 + 2]
mov word [edi], bx
add esp, 0xc
inc edi
inc edi
mov word [edi], bx
inc edi
inc edi
mov dword [edi], ebx
mov ecx, dword [ebp + 0x60]
push ebx
push 0x11
push ebx
push str.DEVI_ID__END
call fcn.0041b06a
mov esi, dword [ebp + 0x28]
cmp esi, ebx
mov word [edi - 2], bx
je 0x42aecd
push 0x4c1b94
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 0x60]
mov edi, dword [ebp - 0x38]
push ebx
push 0xffffffffffffffff
push ebx
push esi
call fcn.0040f3c5
jmp 0x42ae77
inc esi
inc esi
cmp word [esi], 0x26
je 0x42ae75
cmp eax, ebx
jne 0x42ae9a
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 0x60]
push 0x400032
push eax
push edi
push esi
call fcn.004130ae
jmp 0x42aec2
mov cl, byte [eax + 0x17]
and cl, 0xc0
cmp cl, 0xc0
jne 0x42aeae
cmp dword [eax + 0x10], 0x400032
jb 0x42aec2
cmp cl, bl
je 0x42aeb5
mov dword [eax + 4], ebx
push 0x400032
push edi
mov ecx, eax
call fcn.00402ce6
push 0x4c1b94
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x30]
call dword [0x4c0e6c]
cmp byte [ebp - 0x4c], bl
jne 0x42aef0
push 0x4a69d4
push 0x4a9c18
push dword [ebp + 0x60]
call fcn.0040f70e
add esp, 0xc
mov edi, dword [ebp - 0xb4]
mov ecx, dword [ebp + 0x4c]
lea eax, [edi + edi]
push 8
mov esi, 0x4aba78
add ecx, eax
push esi
push ecx
mov dword [ebp + 0x10], eax
call fcn.004128b6
add esp, 0xc
cmp dword [ebp + 0x20], ebx
jne 0x42b774
cmp dword [ebp - 0x30], ebx
je 0x42bb8e
cmp byte [ebp - 0x4c], bl
jne 0x42af4a
mov eax, dword [ebp - 4]
cmp word [eax], bx
je 0x42bb9a
cmp dword [ebp - 0xb8], ebx
jne 0x42bba6
cmp dword [ebp + 0xc], ebx
je 0x42bba6
mov eax, dword [ebp - 0x74]
cmp eax, ebx
je 0x42af5b
cmp word [eax], 0x2a
jne 0x42b01c
cmp dword [ebp + 0x58], ebx
je 0x42af6a
cmp byte [ebp - 0x48], bl
jne 0x42af73
cmp byte [ebp - 0x44], bl
jne 0x42af73
cmp byte [ebp - 0x48], bl
jne 0x42b021
lea ecx, [ebp + 0x30]
call fcn.0043dd7e
push 0x4aba70
push str.devi
push ebx
lea eax, [ebp + 0x30]
push ebx
push eax
call fcn.0040556e
add esp, 0x14
push 0x105
lea ecx, [ebp - 0x98]
call fcn.0043dd9c
push 0x104
push dword [ebp - 0x98]
push dword [ebp + 0x30]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov eax, dword [ebp - 0x98]
cmp word [eax], bx
je 0x42afce
mov ecx, dword [ebp + 0x30]
mov dword [ebp + 0x30], eax
mov dword [ebp - 0x98], ecx
push 0x4a754c
lea ecx, [ebp + 0x30]
call fcn.0043ddea
push dword [ebp + 0x30]
lea ecx, [ebp - 0xb0]
call fcn.004100ca
cmp byte [ebp - 0x48], bl
jne 0x42b003
cmp byte [ebp - 0x44], bl
jne 0x42b003
push eax
mov dword [ebp - 0x70], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov word [ebp - 0x4e], ax
jmp 0x42b006
mov dword [ebp - 0x74], eax
lea ecx, [ebp - 0x98]
call fcn.00437e1a
lea ecx, [ebp + 0x30]
call fcn.00437e1a
mov eax, dword [ebp - 0x74]
cmp byte [ebp - 0x48], bl
je 0x42b036
cmp byte [ebp - 0x4c], bl
jne 0x42b036
cmp eax, ebx
je 0x42b036
cmp byte [ebp - 0x47], bl
jne 0x42b036
mov dword [ebp + 0x58], 1
cmp byte [ebp + 0x3b], bl
je 0x42b040
xor eax, eax
mov dword [ebp - 0x74], eax
cmp byte [ebp - 0x47], bl
je 0x42b051
cmp eax, ebx
je 0x42b051
cmp dword [ebp + 0x3c], ebx
je 0x42b051
mov dword [ebp + 0x58], ebx
movzx ecx, word [ebp - 0x50]
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 3
shl ecx, 0x10
or eax, ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp + 0x4c]
push 0xa
add eax, ecx
push str.INF_
push eax
call fcn.004128b6
add esp, 0xc
push 0x1040
lea ecx, [ebp - 0x14]
call fcn.0043dd9c
xor eax, eax
mov dword [ebp - 0x7c4], ebx
mov ecx, 0x93
lea edi, [ebp - 0x7c0]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x7c4]
push eax
push dword [ebp + 0x70]
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], ebx
call fcn.004926a2
add esp, 0xc
cmp dword [ebp - 0x2c], ebx
je 0x42bc12
push dword [ebp + 0x70]
lea ecx, [ebp + 8]
call fcn.00446497
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x70]
call fcn.0044aefe
pop ecx
pop ecx
push 0x4a754c
lea ecx, [ebp + 8]
call fcn.0043ddea
push str.DefaultInstall_132
lea ecx, [ebp]
call fcn.00446497
push dword [ebp]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
push dword [ebp + 8]
mov dword [ebp + 0x48], eax
call esi
cmp dword [ebp + 0x58], ebx
mov ecx, eax
mov eax, dword [ebp + 8]
mov dword [ebp + 0x10], ecx
mov word [eax + ecx*2], bx
jne 0x42b126
cmp byte [ebp - 0x4c], bl
mov dword [ebp + 0x6c], 1
je 0x42b129
mov dword [ebp + 0x6c], ebx
mov eax, dword [ebp - 0x74]
neg eax
sbb eax, eax
and eax, 0x20000
add eax, 0x10000
or dword [ebp + 0x1c], eax
jmp 0x42b142
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x14]
mov word [eax], bx
test byte [ebp - 0x7c4], 0x10
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x54], ebx
jne 0x42b3f0
mov eax, dword [ebp + 8]
mov word [eax + ecx*2], bx
lea eax, [ebp - 0x798]
push eax
lea ecx, [ebp + 8]
call fcn.0043ddea
lea eax, [ebp - 0x7c]
push eax
push 0x4296cc
push ebx
push dword [ebp + 8]
call dword [0x4c0e7c]
cmp dword [ebp + 0x58], ebx
je 0x42b299
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x64]
jae 0x42b290
movzx esi, word [eax + 4]
add eax, 6
cmp byte [ebp + 0x5d], 1
lea edi, [eax + esi*2 + 4]
mov dword [ebp + 0x20], eax
movzx eax, word [edi - 2]
lea eax, [edi + eax*2 + 2]
mov dword [ebp - 0x84], eax
jbe 0x42b1d3
push 0xffffffffffffffff
push dword [ebp + 0x20]
lea ecx, [ebp - 0x7c]
call fcn.0040ffaf
test eax, eax
jne 0x42b285
cmp byte [ebp - 0x44], bl
mov dword [ebp + 0x64], 4
je 0x42b1f0
push dword [ebp + 0x1c]
lea ecx, [ebp - 0x7c]
push edi
call fcn.0041ff66
jmp 0x42b285
cmp byte [ebp - 0x48], 3
je 0x42b1fb
cmp byte [ebp - 0x46], bl
je 0x42b234
or dword [ebp + 0x64], 1
cmp byte [ebp - 0x46], bl
je 0x42b213
push esi
push dword [ebp + 0x20]
lea ecx, [ebp - 0x7c]
push edi
call fcn.00420717
jmp 0x42b226
cmp byte [ebp - 0x48], 3
jne 0x42b229
push esi
push dword [ebp + 0x20]
lea ecx, [ebp - 0x7c]
push edi
call fcn.0042080d
mov dword [ebp + 0x6c], eax
cmp dword [ebp + 0x6c], ebx
je 0x42b285
test byte [ebp + 0x64], 2
jne 0x42b25a
or dword [ebp + 0x64], 2
push ebx
push esi
push dword [ebp + 0x1c]
lea eax, [ebp - 0x7c]
push edi
push dword [ebp + 0x20]
push eax
call fcn.0041fe18
add esp, 0x18
cmp eax, ebx
mov dword [ebp + 0x6c], eax
je 0x42b285
test byte [ebp + 0x64], 1
je 0x42b1fb
test byte [ebp + 0x64], 4
jne 0x42b285
mov eax, dword [ebp]
mov ecx, dword [ebp + 0x48]
mov word [eax + ecx*2], bx
push edi
lea ecx, [ebp]
call fcn.0043ddea
push 0x100000
push dword [ebp]
push ebx
push ebx
call fcn.00420963
add esp, 0x10
mov eax, dword [ebp - 0x84]
jmp 0x42b193
cmp dword [ebp + 0x58], ebx
jne 0x42b3f0
cmp byte [ebp - 0x47], bl
je 0x42b3f0
cmp dword [ebp + 0x3c], ebx
je 0x42b3f0
cmp dword [ebp - 0x74], ebx
je 0x42b3f0
push dword [ebp - 0x74]
lea ecx, [ebp - 0x10]
call fcn.00446497
push dword [ebp + 0x3c]
lea ecx, [ebp - 0x10]
call fcn.0043ddea
push 0x2800
lea ecx, [ebp - 0x34]
call fcn.0043dd9c
push dword [ebp - 0x10]
push str.:_6R
push 0x27ff
push dword [ebp - 0x34]
call fcn.00493438
add esp, 0x10
push ebx
push 0x11
push ebx
push dword [ebp - 0x34]
mov ecx, 0x4c0fb8
call fcn.0041b06a
lea ecx, [ebp - 0x34]
call fcn.00437e1a
push ebx
push dword [ebp - 0x10]
lea eax, [ebp - 0x7c]
push eax
call fcn.0041fd20
mov esi, eax
add esp, 0xc
cmp esi, ebx
mov edi, esi
jne 0x42b325
mov edi, 0x4a69d4
cmp byte [ebp - 0x48], 3
mov dword [ebp + 0x64], 4
je 0x42b337
cmp byte [ebp - 0x46], bl
je 0x42b37b
or dword [ebp + 0x64], 1
cmp byte [ebp - 0x46], bl
je 0x42b350
push 0xffffffffffffffff
push edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x7c]
call fcn.00420717
jmp 0x42b364
cmp byte [ebp - 0x48], 3
jne 0x42b367
push 0xffffffffffffffff
push edi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x7c]
call fcn.0042080d
mov dword [ebp + 0x6c], eax
inc dword [ebp + 0x64]
cmp dword [ebp + 0x64], 2
jge 0x42b3e1
cmp dword [ebp + 0x6c], ebx
je 0x42b3e1
test byte [ebp + 0x64], 2
jne 0x42b3b4
or dword [ebp + 0x64], 2
cmp esi, ebx
je 0x42b39c
push ebx
push 0xffffffffffffffff
push dword [ebp + 0x1c]
lea eax, [ebp - 0x7c]
push dword [ebp - 0x10]
push esi
push eax
call fcn.0041fe18
add esp, 0x18
mov dword [ebp + 0x6c], eax
inc dword [ebp + 0x64]
cmp dword [ebp + 0x64], 2
jge 0x42b3e1
cmp esi, ebx
je 0x42b3ae
cmp dword [ebp + 0x6c], ebx
je 0x42b3e1
test byte [ebp + 0x64], 2
je 0x42b337
test byte [ebp + 0x64], 4
jne 0x42b3e1
mov eax, dword [ebp]
mov ecx, dword [ebp + 0x48]
mov word [eax + ecx*2], bx
push dword [ebp - 0x10]
lea ecx, [ebp]
call fcn.0043ddea
push 0x100000
push dword [ebp]
push ebx
push ebx
call fcn.00420963
add esp, 0x10
cmp esi, ebx
je 0x42b3e8
mov word [esi], bx
lea ecx, [ebp - 0x10]
call fcn.00437e1a
lea eax, [ebp - 0x7c4]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00405248
test eax, eax
jne 0x42b13f
lea ecx, [ebp - 0x2c]
call fcn.00402b8f
cmp dword [ebp + 0x6c], ebx
mov eax, dword [ebp - 0x9c]
mov word [eax], 0x5f
jne 0x42b422
mov dword [ebp + 0x2c], ebx
cmp dword [ebp + 0x58], ebx
je 0x42bc1b
cmp dword [ebp - 0x74], ebx
je 0x42bc1b
cmp byte [ebp - 0x48], 1
jne 0x42bc1b
cmp byte [ebp + 0x3b], bl
jne 0x42bc1b
cmp dword [ebp + 0x3c], ebx
jne 0x42bc1b
cmp byte [ebp - 0x1d], bl
jne 0x42bc1b
lea ecx, [ebp]
mov dword [ebp - 0x74], ebx
mov byte [ebp + 0x3b], 1
call fcn.00437e1a
lea ecx, [ebp + 8]
call fcn.00437e1a
lea ecx, [ebp - 0x2c]
call fcn.00402b8f
lea ecx, [ebp - 0x14]
call fcn.00437e1a
lea ecx, [ebp + 0x40]
call fcn.00437e1a
lea ecx, [ebp + 0x24]
call fcn.00437e1a
lea ecx, [ebp + 0x50]
call fcn.00437e1a
mov esi, dword [ebp - 4]
jmp 0x4298bf
mov eax, dword [ebp + 0x70]
push 0x1e5
mov dword [ebp + 0x48], eax
lea eax, [ebp + 0x48]
push ebx
push eax
call fcn.00419202
mov esi, dword [ebp + 0x48]
add esp, 0xc
mov dword [ebp + 0x70], eax
cmp word [esi], bx
je 0x429978
push str.35:INDATABuildInfCache
lea ecx, [ebp + 0x7c]
call fcn.00446497
push esi
lea ecx, [ebp + 0x7c]
call fcn.0043ddea
push dword [ebp + 0x7c]
mov ecx, dword [ebp + 0x60]
call fcn.0042f370
lea ecx, [ebp + 0x7c]
mov ebx, eax
call fcn.00437e1a
jmp 0x42bccf
mov dword [ebp + 0x2c], 0x80070057
jmp 0x42bc6b
cmp edi, ebx
jne 0x42b511
mov esi, 0x80070057
jmp 0x42bc8f
push 2
lea ecx, [ebp + 0x7c]
call fcn.0043dd9c
cmp byte [ebp + 0x6b], 0x12
mov eax, dword [ebp + 0x7c]
mov word [eax], bx
mov dword [ebp + 0x10], edi
je 0x42b530
cmp word [edi], 0x26
jne 0x42b55b
mov dword [ebp - 0xe8], edi
jmp 0x42b549
cmp ax, 0x3a
je 0x42b553
cmp ax, 0x3d
je 0x42b553
inc edi
inc edi
mov dword [ebp + 0x58], edi
mov ax, word [edi]
cmp ax, bx
jne 0x42b538
jmp 0x42b55b
mov word [edi], bx
inc edi
inc edi
mov dword [ebp + 0x58], edi
mov edi, dword [ebp + 0x58]
mov ax, word [edi]
cmp ax, 0x22
je 0x42b576
cmp ax, 0x27
je 0x42b576
mov dword [ebp + 0x58], 0x4a69d4
jmp 0x42b5a4
mov al, byte [edi]
movsx ax, al
add edi, 2
mov dword [ebp + 0x58], edi
push eax
lea eax, [ebp + 0x58]
call fcn.004128fe
mov eax, dword [ebp + 0x58]
cmp word [eax], bx
pop ecx
je 0x42b59c
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x58], eax
lea ecx, [ebp + 0x58]
call fcn.0040e2c3
xor eax, eax
mov ax, word [edi]
xor esi, esi
mov ecx, eax
or ecx, 0x20
cmp cx, 0x68
jne 0x42b5c4
cmp word [edi + 2], 0x3a
jne 0x42b5c4
mov esi, 0x200
jmp 0x42b5f9
cmp cx, 0x63
jne 0x42b5d8
cmp word [edi + 2], 0x3a
jne 0x42b5d8
mov esi, 0x400
jmp 0x42b5f9
cmp ax, 0x2b
jne 0x42b5ec
cmp word [edi + 2], 0x3a
jne 0x42b5ec
mov esi, 0x600
jmp 0x42b5f9
cmp ax, 0x40
jne 0x42b5fc
cmp word [edi + 2], 0x3a
jne 0x42b5fc
add edi, 4
mov ax, word [edi]
cmp ax, 0x22
je 0x42b60b
cmp ax, 0x27
jne 0x42b62b
mov al, byte [edi]
movsx ax, al
inc edi
inc edi
mov dword [ebp + 0x48], edi
push eax
lea eax, [ebp + 0x48]
call fcn.004128fe
mov eax, dword [ebp + 0x48]
cmp word [eax], bx
pop ecx
je 0x42b62b
mov word [eax], bx
cmp byte [ebp + 0x6b], 0x11
jne 0x42b697
mov cx, word [edi]
xor esi, esi
cmp cx, 0x22
mov eax, edi
je 0x42b644
cmp cx, 0x27
jne 0x42b66f
mov al, byte [edi]
movsx ax, al
add edi, 2
mov dword [ebp + 0x48], edi
push eax
lea eax, [ebp + 0x48]
call fcn.004128fe
mov eax, dword [ebp + 0x48]
cmp word [eax], bx
pop ecx
je 0x42b67f
mov word [eax], bx
jmp 0x42b66d
cmp cx, 0x3a
je 0x42b679
inc eax
inc eax
mov cx, word [eax]
cmp cx, bx
jne 0x42b667
jmp 0x42b67f
mov word [eax], bx
lea esi, [eax + 2]
lea eax, [ebp - 0x4a]
push eax
push 0xfffffffffffffff0
push 1
push esi
lea eax, [ebp - 0x7c]
push edi
push eax
call fcn.0041fe18
add esp, 0x18
jmp 0x42b6c7
movsx ecx, byte [ebp + 0x6b]
lea eax, [ebp - 0x4a]
push eax
lea eax, [ebp + 0x7c]
push eax
mov al, byte [ebp + 0x39]
neg al
push 0x100
push edi
sbb eax, eax
and eax, 0x10000
or eax, ecx
or eax, esi
or eax, 0x800
push eax
call fcn.0044836a
add esp, 0x14
mov esi, eax
mov eax, dword [ebp + 0x58]
cmp word [eax], bx
jne 0x42b55b
cmp byte [ebp + 0x6b], 0x12
jne 0x42b6e9
push dword [ebp + 0x7c]
mov ecx, dword [ebp + 0x60]
push dword [ebp + 0x10]
call fcn.0043d658
lea ecx, [ebp + 0x7c]
jmp 0x42b76a
xor eax, eax
mov al, byte [ebp + 0x6a]
and eax, 0x12
push eax
push ebx
call fcn.0048574a
pop ecx
pop ecx
jmp 0x42bccf
mov dword [ebp + 0x2c], ebx
jmp 0x42bc63
mov dword [ebp + 0x2c], 1
jmp 0x42bc5b
cmp byte [ebp + 0x39], bl
je 0x42b747
mov eax, dword [ebp + 0x40]
cmp word [eax], bx
je 0x42b747
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 0x40]
mov word [ecx + eax*2], 0xd
mov ecx, dword [ebp + 0x40]
mov word [ecx + eax*2 + 2], 0xa
mov ecx, dword [ebp + 0x40]
mov word [ecx + eax*2 + 4], bx
push dword [ebp + 0x40]
mov ecx, dword [ebp + 0x60]
push dword [ebp + 4]
call fcn.0043d658
lea ecx, [ebp + 0x40]
xor esi, esi
call fcn.00437e1a
lea ecx, [ebp + 0x24]
call fcn.00437e1a
lea ecx, [ebp + 0x50]
call fcn.00437e1a
jmp 0x42bc8f
cmp dword [ebp + 0x58], ebx
mov dword [ebp + 0x28], ebx
jne 0x42b7ab
mov eax, dword [ebp - 4]
cmp word [eax], bx
jne 0x42b7ab
cmp byte [ebp - 0x47], bl
jne 0x42b7ab
lea ecx, [ebp + 0x40]
call fcn.00437e1a
lea ecx, [ebp + 0x24]
call fcn.00437e1a
lea ecx, [ebp + 0x50]
call fcn.00437e1a
mov ebx, 0x491
jmp 0x42bccf
lea eax, [edi + 4]
mov dword [ebp - 0x88], eax
add eax, 0x3c
push eax
lea ecx, [ebp + 4]
call fcn.0043dd9c
mov eax, dword [ebp + 0x4c]
push 0x22
add edi, edi
add eax, edi
push str.System32DRIVERS
push eax
call fcn.004128b6
push dword [ebp + 0x4c]
call fcn.004925aa
add esp, 0x10
test eax, eax
jne 0x42b7ed
push ebx
push dword [ebp + 0x4c]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp + 0x4c]
push 8
add eax, edi
push esi
push eax
call fcn.004128b6
push dword [ebp + 0x4c]
call fcn.004925aa
add esp, 0x10
test eax, eax
jne 0x42b814
push ebx
push dword [ebp + 0x4c]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp + 0x4c]
push 0xa
add eax, edi
push str.INF_
push eax
call fcn.004128b6
movzx eax, word [ebp - 0x50]
shl eax, 0x10
mov dword [ebp + 0xc], eax
xor eax, eax
mov dword [ebp - 0x574], ebx
mov ecx, 0x93
lea edi, [ebp - 0x570]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x574]
push eax
push dword [ebp + 0x70]
lea eax, [ebp + 0x30]
push eax
mov dword [ebp + 0x30], ebx
call fcn.004926a2
add esp, 0x18
cmp dword [ebp + 0x30], ebx
jne 0x42b87a
lea ecx, [ebp + 0x30]
mov dword [ebp + 0x2c], 2
call fcn.00402b8f
lea ecx, [ebp + 4]
jmp 0x42bc4e
push dword [ebp + 0x70]
lea ecx, [ebp + 0x60]
call fcn.00446497
lea eax, [ebp + 0x60]
push eax
push dword [ebp + 0x70]
call fcn.0044aefe
pop ecx
pop ecx
push 0x4a754c
lea ecx, [ebp + 0x60]
call fcn.0043ddea
mov esi, dword [ebp + 0x1c]
cmp esi, ebx
je 0x42b8ac
cmp word [esi], bx
jne 0x42b8b1
mov esi, 0x4ab9c4
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x42b8bd
cmp word [eax], bx
jne 0x42b8c2
mov eax, str.DefaultInstall
push eax
lea ecx, [ebp + 0x3c]
call fcn.00446497
mov edi, 0x4a7360
push edi
lea ecx, [ebp + 0x3c]
call fcn.0043ddea
push esi
lea ecx, [ebp + 0x3c]
call fcn.0043ddea
push edi
lea ecx, [ebp + 0x3c]
call fcn.0043ddea
push dword [ebp + 0x3c]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call edi
push dword [ebp + 0x60]
mov dword [ebp - 0xc4], eax
call edi
mov dword [ebp + 0x10], eax
test byte [ebp - 0x574], 0x10
jne 0x42bb37
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x10]
mov word [eax + ecx*2], bx
lea eax, [ebp - 0x548]
push eax
lea ecx, [ebp + 0x60]
call fcn.0043ddea
mov esi, dword [ebp + 0x60]
lea ecx, [ebp + 0x14]
mov dword [ebp - 0x84], esi
mov byte [ebp + 0x7f], bl
call fcn.0043dd7e
mov eax, dword [ebp + 4]
mov dword [ebp + 0x48], ebx
mov word [eax], bx
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x14]
push eax
push esi
call fcn.00485e2a
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x48]
sub eax, dword [ebp + 0x14]
add esp, 0xc
sar eax, 1
cmp dword [ebp - 0x88], eax
jne 0x42b987
push dword [ebp - 0x88]
push dword [ebp + 0x14]
push dword [ebp + 0x4c]
call fcn.0040e1aa
add esp, 0xc
test al, al
je 0x42b987
mov byte [ebp + 0x7f], 1
cmp dword [ebp - 0xd0], ebx
je 0x42b996
mov esi, dword [ebp + 0x64]
cmp esi, ebx
jne 0x42b9a8
push ebx
push dword [ebp + 0x60]
lea eax, [ebp - 0x7c]
push eax
call fcn.0041fd20
add esp, 0xc
mov esi, eax
cmp byte [ebp - 0x47], bl
jne 0x42b9c5
cmp dword [ebp + 0x58], ebx
jne 0x42ba03
cmp byte [ebp + 0x47], bl
je 0x42b9bc
cmp byte [ebp + 0x7f], bl
jne 0x42ba03
cmp esi, ebx
jne 0x42ba03
jmp 0x42bb2f
push 0x2800
lea ecx, [ebp - 0x34]
call fcn.0043dd9c
push dword [ebp + 0x60]
push str.:_6R
push 0x27ff
push dword [ebp - 0x34]
call fcn.00493438
add esp, 0x10
push ebx
push 0x11
push ebx
push dword [ebp - 0x34]
mov ecx, 0x4c0fb8
call fcn.0041b06a
lea ecx, [ebp - 0x34]
call fcn.00437e1a
cmp esi, ebx
mov edi, esi
je 0x42ba15
movzx eax, word [esi - 4]
mov dword [ebp - 0x8c], eax
jmp 0x42ba1b
mov dword [ebp - 0x8c], ebx
cmp esi, ebx
jne 0x42ba24
mov edi, 0x4a69d4
cmp dword [ebp + 0x58], ebx
mov dword [ebp + 0x7c], 4
jne 0x42bac7
cmp byte [ebp - 0x44], bl
je 0x42ba4c
push dword [ebp + 0xc]
lea ecx, [ebp - 0x7c]
push dword [ebp + 0x60]
call fcn.0041ff66
jmp 0x42bb19
cmp byte [ebp - 0x48], 3
je 0x42ba57
cmp byte [ebp - 0x46], bl
je 0x42ba96
or dword [ebp + 0x7c], 1
cmp byte [ebp - 0x46], bl
je 0x42ba70
push 0xffffffffffffffff
push edi
push dword [ebp + 0x60]
lea ecx, [ebp - 0x7c]
call fcn.00420717
jmp 0x42ba84
cmp byte [ebp - 0x48], 3
jne 0x42ba87
push 0xffffffffffffffff
push edi
push dword [ebp + 0x60]
lea ecx, [ebp - 0x7c]
call fcn.0042080d
mov dword [ebp + 0x28], eax
cmp dword [ebp + 0x28], ebx
je 0x42bb19
test byte [ebp + 0x7c], 2
jne 0x42bac1
or dword [ebp + 0x7c], 2
cmp esi, ebx
je 0x42babb
push ebx
push 0xffffffffffffffff
push dword [ebp + 0xc]
lea eax, [ebp - 0x7c]
push dword [ebp + 0x60]
push esi
push eax
call fcn.0041fe18
add esp, 0x18
cmp eax, ebx
mov dword [ebp + 0x28], eax
je 0x42bb19
test byte [ebp + 0x7c], 1
je 0x42ba57
test byte [ebp + 0x7c], 4
jne 0x42bb19
cmp byte [ebp - 0x44], bl
jne 0x42ba39
cmp byte [ebp - 0x45], bl
jne 0x42bb19
mov eax, dword [ebp + 0x3c]
mov ecx, dword [ebp - 0xc4]
push dword [ebp - 0x84]
mov word [eax + ecx*2], bx
lea ecx, [ebp + 0x3c]
call fcn.0043ddea
push ebx
push dword [ebp + 0x3c]
push ebx
push ebx
call fcn.00420963
add esp, 0x10
cmp eax, ebx
mov dword [ebp + 0x28], eax
jne 0x42bb19
cmp dword [ebp - 0x6c], ebx
je 0x42bb19
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x7c]
push edi
call fcn.0040ffd5
cmp esi, ebx
je 0x42bb20
mov word [esi], bx
mov eax, dword [ebp + 4]
cmp word [eax], bx
je 0x42bb2f
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp + 0x14]
call fcn.00437e1a
lea eax, [ebp - 0x574]
push eax
lea ecx, [ebp + 0x30]
call fcn.00405248
test eax, eax
jne 0x42b904
lea ecx, [ebp + 0x3c]
call fcn.00437e1a
lea ecx, [ebp + 0x60]
call fcn.00437e1a
lea ecx, [ebp + 0x30]
call fcn.00402b8f
lea ecx, [ebp + 4]
call fcn.00437e1a
lea ecx, [ebp + 0x40]
call fcn.00437e1a
lea ecx, [ebp + 0x24]
call fcn.00437e1a
lea ecx, [ebp + 0x50]
call fcn.00437e1a
mov ebx, dword [ebp + 0x28]
jmp 0x42bccf
mov dword [ebp + 0x2c], 1
jmp 0x42bc53
mov dword [ebp + 0x2c], 0x491
jmp 0x42bc53
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
dec ecx
cmp ecx, 1
jl 0x42bbd3
mov eax, dword [ebp + 0x70]
lea edx, [eax + ecx*2]
xor eax, eax
mov ax, word [edx]
push eax
call fcn.0040e33b
add esp, 4
test al, al
je 0x42bbd3
mov word [edx], bx
dec ecx
cmp ecx, ebx
jge 0x42bbe0
mov dword [ebp + 0x2c], 0x80070057
jmp 0x42bc53
mov ecx, dword [ebp - 0x18]
cmp ecx, ebx
je 0x42bbee
cmp word [ecx], bx
jne 0x42bbee
xor ecx, ecx
push dword [ebp - 0xd8]
xor eax, eax
mov al, byte [ebp + 0x38]
or eax, 0x10
push eax
push ecx
lea eax, [ebp - 0x7c]
push eax
push dword [ebp + 0x70]
call fcn.00429061
add esp, 0x14
mov dword [ebp + 0x2c], eax
jmp 0x42bc53
mov dword [ebp + 0x2c], 2
jmp 0x42bc43
push 0x4a69d4
push 0x4a9c18
push dword [ebp + 0x60]
mov dword [ebp - 0x74], ebx
call fcn.0040f70e
add esp, 0xc
lea ecx, [ebp]
call fcn.00437e1a
lea ecx, [ebp + 8]
call fcn.00437e1a
lea ecx, [ebp - 0x2c]
call fcn.00402b8f
lea ecx, [ebp - 0x14]
call fcn.00437e1a
lea ecx, [ebp + 0x40]
call fcn.00437e1a
lea ecx, [ebp + 0x24]
call fcn.00437e1a
lea ecx, [ebp + 0x50]
call fcn.00437e1a
lea ecx, [ebp - 0xac]
call fcn.004100fa
lea ecx, [ebp - 0xb0]
call fcn.0042092b
lea ecx, [ebp - 0xcc]
call fcn.0042092b
mov esi, dword [ebp + 0x2c]
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0xfc]
call fcn.00410127
lea eax, [ebp - 0x4a]
mov ax, word [eax]
cmp ax, 0x40
je 0x42bcc4
push str.0x_X
push dword [ebp - 0xe8]
movzx eax, ax
push eax
push dword [ebp + 0x60]
call fcn.00440210
add esp, 0x10
mov ecx, dword [ebp + 0x60]
push ebx
call fcn.004628c6
mov ebx, esi
lea ecx, [ebp - 0x38]
call fcn.00437e1a
lea ecx, [ebp + 0x4c]
call fcn.00437e1a
lea ecx, [ebp - 0xcc]
call fcn.00437e1a
lea ecx, [ebp - 0xb0]
call fcn.00437e1a
lea ecx, [ebp - 0xe0]
call fcn.00437e1a
lea ecx, [ebp - 0x9c]
call fcn.00437e1a
lea ecx, [ebp - 0xa8]
call fcn.00437e1a
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x74
leave
ret 4