Function at 0x409066
Capabilities:
Check if file exists
Check os version
Create directory
Create process on windows
Create shortcut via ishelllink
Delete directory
Delete file
Get common file path
Get file size
Get system information on windows
Move file
Persist via lnk shortcut
Read file on windows
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push 0x984
mov eax, 0x451a24
call fcn.0044d453
xor edi, edi
mov ebx, ecx
mov dword [ebp - 0x690], ebx
mov dword [ebp - 0x7d4], edi
mov dword [ebp - 0x7d0], edi
mov dword [ebp - 0x7cc], edi
mov dword [ebp - 0x7c4], edi
mov dword [ebp - 0x7c0], edi
mov dword [ebp - 0x7bc], edi
lea eax, [ebp - 0x6ec]
push eax
lea eax, [ebp - 0x708]
push eax
mov dword [ebp - 4], edi
call fcn.00407b26
pop ecx
pop ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x708]
cmp dword [ecx - 0xc], edi
je 0x409101
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x409101
mov eax, dword [ebp - 0x708]
push ecx
add eax, 0xfffffff0
mov dword [ebx + 0x12d0], 3
mov dword [ebp - 0x6ec], esp
mov esi, esp
call fcn.00406215
add eax, 0x10
push ebx
mov dword [esi], eax
call fcn.0040baea
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x698], eax
lea esi, [ebp - 0x70c]
mov byte [ebp - 4], 2
call fcn.004192a0
mov dword [ebp - 0x6c8], edi
mov dword [ebp - 0x418], 0xf
mov dword [ebp - 0x41c], edi
mov byte [ebp - 0x42c], 0
push ecx
mov byte [ebp - 4], 4
mov eax, esp
mov dword [ebp - 0x6ec], esp
push eax
mov ecx, 0x458608
call fcn.004061b9
push ebx
call fcn.0040d845
push edi
push 0x80
push 3
push edi
push 1
push connect
push dword [ebp - 0x70c]
mov dword [ebp - 0x6f0], edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x409207
push edi
push esi
mov dword [ebp - 0x7b0], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x6f0], eax
xor eax, eax
push 0x3e
mov word [ebp - 0x520], ax
lea eax, [ebp - 0x51e]
push edi
push eax
call fcn.00438e30
add esp, 0xc
push edi
lea eax, [ebp - 0x7b0]
push eax
push 0x40
lea eax, [ebp - 0x520]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x409200
mov eax, dword [ebp - 0x4e4]
push edi
push edi
add eax, 0xfffffffc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 0x7b0]
push eax
push 4
lea eax, [ebp - 0x6c8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x6c8]
cmp eax, edi
jbe 0x40b96a
cmp eax, dword [ebp - 0x6f0]
ja 0x40b96a
mov ecx, dword [ebp - 0x70c]
lea esi, [ebp - 0x42c]
call fcn.00418c20
test eax, eax
jne 0x409284
push 2
pop ebx
push 1
xor edi, edi
lea esi, [ebp - 0x42c]
call fcn.0040138b
mov eax, dword [ebp - 0x70c]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0x698]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0x708]
add eax, 0xfffffff0
call fcn.00402c12
lea esi, [ebp - 0x7d4]
call fcn.004185c0
mov eax, ebx
jmp 0x40b9b1
cmp dword [ebx + 0x468], edi
jne 0x409a73
push 0x24
lea eax, [ebp - 0x944]
push edi
push eax
call fcn.00438e30
add esp, 0xc
lea eax, [ebp - 0x944]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 9
pop eax
xor ecx, ecx
cmp ax, word [ebp - 0x944]
sete cl
push ecx
mov eax, esp
mov dword [ebp - 0x78c], ecx
mov dword [ebp - 0x6ec], esp
push eax
mov ecx, 0x458620
call fcn.004061b9
push ebx
call fcn.0040d845
push dword [ebx + 0x478]
lea eax, [ebp - 0x698]
push str._sReposImages
push eax
call fcn.004058ae
mov esi, dword [ebp - 0x698]
add esp, 0xc
mov eax, esi
call fcn.00419050
lea eax, [esi - 0x10]
call fcn.00406215
add eax, 0x10
mov dword [ebp - 0x68c], eax
push str.iToolsVM.ova
lea eax, [ebp - 0x68c]
push eax
mov byte [ebp - 4], 5
call fcn.00408772
push str.iToolsVM.ova.temp
lea eax, [ebp - 0x698]
push eax
call fcn.00408772
mov dword [ebp - 0x864], edi
mov dword [ebp - 0x860], edi
mov dword [ebp - 0x85c], edi
mov dword [ebp - 0x854], edi
mov dword [ebp - 0x850], edi
mov dword [ebp - 0x84c], edi
mov byte [ebp - 4], 6
mov eax, dword [section..data]
mov esi, section..data
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6e8], eax
mov byte [ebp - 4], 7
mov eax, dword [section..data]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x69c], eax
mov byte [ebp - 4], 8
push 0x13c
mov dword [ebp - 0x6e0], edi
mov dword [ebp - 0x6dc], edi
mov dword [ebp - 0x748], edi
mov dword [ebp - 0x744], edi
call fcn.0043945e
pop ecx
mov dword [ebp - 0x6ec], eax
mov byte [ebp - 4], 9
cmp eax, edi
je 0x4093d9
mov edi, eax
call fcn.0040fc1a
mov esi, eax
mov dword [ebp - 0x6e4], esi
jmp 0x4093e1
mov dword [ebp - 0x6e4], edi
mov esi, edi
xor edi, edi
mov byte [ebp - 4], 8
mov dword [ebp - 0x8cc], esi
cmp esi, edi
je 0x4093f8
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 0x434], 0xf
mov dword [ebp - 0x438], edi
mov byte [ebp - 0x448], 0
push edi
lea ecx, [ebp - 0x448]
push ecx
push str._getova
push 0x50
mov byte [ebp - 4], 0xb
mov eax, dword [esi]
push str.serv2_avm.itools.hk
mov ecx, esi
call dword [eax + 0x84]
test eax, eax
jne 0x4094a9
push ecx
mov eax, esp
mov dword [ebp - 0x6ec], esp
push eax
mov ecx, 0x45833c
call fcn.004061b9
push ebx
call fcn.0040d845
push 1
xor edi, edi
lea esi, [ebp - 0x448]
call fcn.0040138b
mov ecx, dword [ebp - 0x6e4]
mov byte [ebp - 4], 8
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [ebp - 0x69c]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0x6e8]
add eax, 0xfffffff0
call fcn.00402c12
lea esi, [ebp - 0x864]
call fcn.004185c0
mov eax, dword [ebp - 0x68c]
add eax, 0xfffffff0
call fcn.00402c12
push 0xa
jmp 0x409238
fldz
mov dword [ebp - 0x718], edi
fstp qword [ebp - 0x720]
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x434], 0x10
mov ecx, dword [ebp - 0x448]
jae 0x4094d0
lea ecx, [ebp - 0x448]
lea edi, [ebp - 0x720]
call fcn.0041acb0
test al, al
je 0x4096dc
mov esi, str.ova_url
mov edx, esi
mov ecx, edi
call fcn.0041a890
test al, al
je 0x40952c
mov edx, esi
mov ecx, edi
call fcn.0041a620
call fcn.00419f40
mov edi, 0xfde9
push edi
lea ecx, [ebp - 0x864]
push ecx
mov ebx, eax
call fcn.004186b0
push eax
lea eax, [ebp - 0x6e8]
push eax
call fcn.00402b88
mov ebx, dword [ebp - 0x690]
jmp 0x409531
mov edi, 0xfde9
mov esi, str.size
mov edx, esi
lea ecx, [ebp - 0x720]
call fcn.0041a890
test al, al
je 0x409567
mov edx, esi
lea ecx, [ebp - 0x720]
call fcn.0041a620
mov ecx, eax
call fcn.0041a2a0
mov dword [ebp - 0x6e0], eax
mov dword [ebp - 0x6dc], edx
cmp dword [ebp - 0x78c], 0
lea ecx, [ebp - 0x720]
je 0x409622
mov esi, str.vbox_64
mov edx, esi
call fcn.0041a890
test al, al
je 0x4096dc
mov edx, esi
lea ecx, [ebp - 0x720]
call fcn.0041a620
mov edx, 0x457ad8
mov ecx, eax
call fcn.0041a890
test al, al
je 0x4095eb
mov edx, esi
lea ecx, [ebp - 0x720]
call fcn.0041a620
mov edx, 0x457ad8
mov ecx, eax
call fcn.0041a620
call fcn.00419f40
push edi
lea ecx, [ebp - 0x864]
push ecx
mov ebx, eax
call fcn.004186b0
push eax
lea eax, [ebp - 0x69c]
push eax
call fcn.00402b88
mov ebx, dword [ebp - 0x690]
mov edx, esi
lea ecx, [ebp - 0x720]
call fcn.0041a620
mov edi, str.size
mov edx, edi
mov ecx, eax
call fcn.0041a890
test al, al
je 0x4096dc
mov edx, esi
lea ecx, [ebp - 0x720]
call fcn.0041a620
mov edx, edi
jmp 0x4096c2
mov esi, str.vbox_32
mov edx, esi
call fcn.0041a890
test al, al
je 0x4096dc
mov edx, esi
lea ecx, [ebp - 0x720]
call fcn.0041a620
mov edx, 0x457ad8
mov ecx, eax
call fcn.0041a890
test al, al
je 0x409693
mov edx, esi
lea ecx, [ebp - 0x720]
call fcn.0041a620
mov edx, 0x457ad8
mov ecx, eax
call fcn.0041a620
call fcn.00419f40
push edi
lea ecx, [ebp - 0x864]
push ecx
mov ebx, eax
call fcn.004186b0
push eax
lea eax, [ebp - 0x69c]
push eax
call fcn.00402b88
mov ebx, dword [ebp - 0x690]
mov edx, esi
lea ecx, [ebp - 0x720]
call fcn.0041a620
mov edx, str.size
mov ecx, eax
call fcn.0041a890
test al, al
je 0x4096dc
mov edx, esi
lea ecx, [ebp - 0x720]
call fcn.0041a620
mov edx, str.size
mov ecx, eax
call fcn.0041a620
mov ecx, eax
call fcn.0041a2a0
mov dword [ebp - 0x744], edx
mov dword [ebp - 0x748], eax
mov esi, dword [ebp - 0x6e8]
cmp dword [esi - 0xc], 0
je 0x409aea
mov eax, dword [ebp - 0x69c]
cmp dword [eax - 0xc], 0
je 0x409aea
push dword [ebp - 0x68c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40972b
mov eax, dword [ebp - 0x68c]
call fcn.00418d20
cmp eax, dword [ebp - 0x6e0]
jne 0x40972b
cmp edx, dword [ebp - 0x6dc]
je 0x409836
push 0x150
call fcn.0043945e
pop ecx
mov dword [ebp - 0x6ec], eax
mov byte [ebp - 4], 0xd
test eax, eax
je 0x40974c
push eax
call fcn.004033cd
jmp 0x40974e
xor eax, eax
lea edi, [ebx + 0x1310]
push eax
mov byte [ebp - 4], 0xc
call fcn.0040e12a
mov eax, dword [edi]
push esi
push dword [ebp - 0x698]
call fcn.0040379a
mov eax, dword [edi]
mov dword [eax + 0x124], 0x40cdab
mov dword [eax + 0x120], ebx
mov edx, dword [edi]
mov eax, dword [edx + 0x34]
test eax, eax
jne 0x40979c
cmp dword [edx + 0xbc], eax
jne 0x40979c
push 0x4037f6
lea eax, [edx + 0x30]
call fcn.00418240
lea eax, [ebx + 0x12e0]
push eax
call fcn.0043ba1b
mov esi, dword [edi]
pop ecx
lea esi, [esi + 0x30]
call fcn.004183e0
mov edi, dword [edi]
cmp dword [edi + 0x134], 0
je 0x4097ff
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x794], esi
push ecx
mov byte [ebp - 4], 0xe
mov eax, esp
mov dword [ebp - 0x6ec], esp
push eax
mov ecx, 0x45833c
call fcn.004061b9
push ebx
call fcn.0040d845
lea eax, [esi - 0x10]
call fcn.00402c12
jmp 0x409b04
push 0x32
mov eax, ebx
call fcn.0040d75b
push dword [ebp - 0x68c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x409824
push dword [ebp - 0x68c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x68c]
push dword [ebp - 0x698]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push dword [ebx + 0x478]
lea eax, [ebp - 0x698]
push str._sReposSetup
push eax
call fcn.004058ae
mov edi, dword [ebp - 0x698]
add esp, 0xc
mov eax, edi
call fcn.00419050
lea eax, [edi - 0x10]
call fcn.00406215
add eax, 0x10
mov dword [ebp - 0x6a4], eax
cmp dword [ebp - 0x78c], 0
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x6a4]
je 0x409893
push str._vbox64.msi
push eax
call fcn.00408772
push str._vbox64.msi.temp
jmp 0x4098a3
push str._vbox32.msi
push eax
call fcn.00408772
push str._vbox32.msi.temp
lea eax, [ebp - 0x698]
push eax
call fcn.00408772
mov edi, dword [ebp - 0x6a4]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4098db
mov eax, edi
call fcn.00418d20
cmp eax, dword [ebp - 0x748]
jne 0x4098db
cmp edx, dword [ebp - 0x744]
je 0x409a05
push 0x150
call fcn.0043945e
pop ecx
mov dword [ebp - 0x794], eax
mov byte [ebp - 4], 0x10
test eax, eax
je 0x4098fc
push eax
call fcn.004033cd
jmp 0x4098fe
xor eax, eax
lea edi, [ebx + 0x1310]
push eax
mov byte [ebp - 4], 0xf
call fcn.0040e12a
push dword [ebp - 0x69c]
mov eax, dword [edi]
push dword [ebp - 0x698]
call fcn.0040379a
mov eax, dword [edi]
mov dword [eax + 0x124], 0x40cf6f
mov dword [eax + 0x120], ebx
mov edx, dword [edi]
mov eax, dword [edx + 0x34]
test eax, eax
jne 0x409951
cmp dword [edx + 0xbc], eax
jne 0x409951
push 0x4037f6
lea eax, [edx + 0x30]
call fcn.00418240
lea eax, [ebx + 0x12e0]
push eax
call fcn.0043ba1b
mov esi, dword [edi]
pop ecx
lea esi, [esi + 0x30]
call fcn.004183e0
mov edi, dword [edi]
cmp dword [edi + 0x134], 0
je 0x4099bd
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x6dc], esi
push ecx
mov byte [ebp - 4], 0x11
mov eax, esp
mov dword [ebp - 0x794], esp
push eax
mov ecx, 0x45833c
call fcn.004061b9
push ebx
call fcn.0040d845
lea eax, [esi - 0x10]
call fcn.00402c12
mov eax, dword [ebp - 0x6a4]
add eax, 0xfffffff0
jmp 0x4097f5
push ecx
mov eax, esp
mov dword [ebp - 0x6dc], esp
push eax
mov ecx, 0x45878c
call fcn.004061b9
push ebx
call fcn.0040d845
push 0x37
mov eax, ebx
call fcn.0040d75b
mov edi, dword [ebp - 0x6a4]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4099f8
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push dword [ebp - 0x698]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [edi - 0x10]
call fcn.00402c12
lea ecx, [ebp - 0x720]
mov byte [ebp - 4], 0xb
call fcn.0041a0c0
push 1
xor edi, edi
lea esi, [ebp - 0x448]
call fcn.0040138b
mov ecx, dword [ebp - 0x6e4]
mov byte [ebp - 4], 8
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [ebp - 0x69c]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0x6e8]
add eax, 0xfffffff0
call fcn.00402c12
lea esi, [ebp - 0x864]
call fcn.004185c0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x68c]
add eax, 0xfffffff0
call fcn.00402c12
push ecx
mov eax, esp
mov dword [ebp - 0x6dc], esp
push eax
mov ecx, str.ck_W_e
call fcn.004061b9
push ebx
call fcn.0040d845
push 0x37
mov eax, ebx
call fcn.0040d75b
cmp dword [ebp - 0x418], 0x10
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x72c], edi
jae 0x409ab1
lea eax, [ebp - 0x42c]
add eax, dword [ebp - 0x6c8]
push 4
push eax
lea eax, [ebp - 0x72c]
push eax
call fcn.00438eb0
mov esi, dword [ebp - 0x6f0]
mov ecx, dword [ebp - 0x6c8]
mov edx, dword [ebp - 0x72c]
mov eax, esi
sub eax, ecx
add esp, 0xc
cmp edx, eax
jbe 0x409b18
push 3
jmp 0x409238
push ecx
mov eax, esp
mov dword [ebp - 0x6dc], esp
push eax
mov ecx, 0x45833c
call fcn.004061b9
push ebx
call fcn.0040d845
lea ecx, [ebp - 0x720]
mov byte [ebp - 4], 0xb
call fcn.0041a0c0
jmp 0x40944f
cmp dword [ebp - 0x418], 0x10
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x764], edi
jae 0x409b33
lea eax, [ebp - 0x42c]
add eax, edx
lea eax, [eax + ecx + 4]
push 4
push eax
lea eax, [ebp - 0x764]
push eax
call fcn.00438eb0
sub esi, dword [ebp - 0x72c]
add esp, 0xc
sub esi, dword [ebp - 0x6c8]
sub esi, 4
cmp dword [ebp - 0x764], esi
jbe 0x409b69
push 5
jmp 0x409238
lea esi, [ebp - 0x704]
call fcn.00419070
mov esi, eax
push str..zip
mov byte [ebp - 4], 0x12
call fcn.00420fc0
push edx
push eax
push dword [esi]
lea eax, [ebp - 0x698]
push str._s_016I64X_s
push eax
call fcn.004058ae
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x704]
add esp, 0x18
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0x6c8]
mov ecx, dword [ebp - 0x72c]
mov edi, dword [ebp - 0x764]
lea ebx, [ecx + eax + 8]
mov eax, dword [ebp - 0x698]
lea esi, [ebp - 0x42c]
call fcn.00418a00
test eax, eax
jne 0x409be0
push 6
jmp 0x409238
mov eax, dword [ebp - 0x690]
push 0x3c
call fcn.0040d75b
fldz
xor ebx, ebx
fstp qword [ebp - 0x740]
mov dword [ebp - 0x6f0], ebx
mov dword [ebp - 0x6a8], ebx
mov dword [ebp - 0x738], ebx
mov dword [ebp - 0x844], ebx
mov dword [ebp - 0x840], ebx
mov dword [ebp - 0x83c], ebx
mov dword [ebp - 0x834], ebx
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x82c], ebx
mov byte [ebp - 4], 0x14
mov eax, dword [section..data]
mov edi, section..data
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6a0], eax
push 0x4587d8
lea eax, [ebp - 0x6a0]
push eax
mov byte [ebp - 4], 0x15
call fcn.00402b88
mov eax, dword [ebp - 0x6a0]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x6dc], esp
mov esi, esp
mov dword [ebp - 0x704], eax
call fcn.00406215
push dword [ebp - 0x690]
add eax, 0x10
mov dword [esi], eax
call fcn.0040d845
mov dword [ebp - 0x778], ebx
mov dword [ebp - 0x774], ebx
mov dword [ebp - 0x770], ebx
lea eax, [ebp - 0x780]
push eax
mov ecx, str.VBoxSVC.exe
mov byte [ebp - 4], 0x16
call fcn.004061b9
lea ecx, [ebp - 0x780]
lea esi, [ebp - 0x778]
mov byte [ebp - 4], 0x17
call fcn.0040de92
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x780]
add eax, 0xfffffff0
call fcn.00402c12
lea eax, [ebp - 0x79c]
push eax
mov ecx, str.VBoxManage.exe
call fcn.004061b9
lea ecx, [ebp - 0x79c]
mov byte [ebp - 4], 0x18
call fcn.0040de92
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x79c]
add eax, 0xfffffff0
call fcn.00402c12
lea eax, [ebp - 0x7b4]
push eax
mov ecx, str.VBoxHeadless.exe
call fcn.004061b9
lea ecx, [ebp - 0x7b4]
mov byte [ebp - 4], 0x19
call fcn.0040de92
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x7b4]
add eax, 0xfffffff0
call fcn.00402c12
lea eax, [ebp - 0x790]
push eax
mov ecx, str.adb.exe
call fcn.004061b9
lea ecx, [ebp - 0x790]
mov byte [ebp - 4], 0x1a
call fcn.0040de92
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x790]
add eax, 0xfffffff0
call fcn.00402c12
mov esi, dword [ebp - 0x774]
sub esi, dword [ebp - 0x778]
mov dword [ebp - 0x6ac], ebx
sar esi, 2
cmp esi, ebx
jbe 0x409df3
mov eax, dword [section..data]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x74c], eax
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x778]
mov ecx, dword [ebp - 0x6ac]
push dword [eax + ecx*4]
lea ecx, [ebp - 0x74c]
call fcn.0040cb43
test eax, eax
je 0x409dd3
push dword [ebp - 0x74c]
call fcn.0040ca16
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x74c]
add eax, 0xfffffff0
call fcn.00402c12
inc dword [ebp - 0x6ac]
cmp dword [ebp - 0x6ac], esi
jb 0x409d88
mov eax, dword [ebp - 0x698]
call fcn.00434430
mov esi, eax
mov dword [ebp - 0x69c], esi
cmp esi, ebx
jne 0x409e4d
push dword [ebp - 0x698]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebp - 0x778]
call fcn.0040df9c
mov eax, dword [ebp - 0x704]
call fcn.00402c12
lea esi, [ebp - 0x844]
call fcn.004203d0
lea ecx, [ebp - 0x740]
mov byte [ebp - 4], 4
call fcn.0041a0c0
push 7
jmp 0x409238
mov dword [ebp - 0x694], 1
call fcn.00434fe0
cmp eax, ebx
jne 0x40a516
push 0x50
lea eax, [ebp - 0x570]
push ebx
push eax
call fcn.00438e30
add esp, 0xc
push 0x3ff
lea eax, [ebp - 0x40f]
push ebx
push eax
mov byte [ebp - 0x410], bl
call fcn.00438e30
add esp, 0xc
push dword [ebp - 0x69c]
lea eax, [ebp - 0x410]
lea esi, [ebp - 0x570]
call fcn.00434f40
pop ecx
test eax, eax
jne 0x40a6e5
mov dword [ebp - 0x7fc], ebx
mov dword [ebp - 0x7f8], ebx
mov dword [ebp - 0x7f4], ebx
mov dword [ebp - 0x7ec], ebx
mov dword [ebp - 0x7e8], ebx
mov dword [ebp - 0x7e4], ebx
push ebx
lea eax, [ebp - 0x7fc]
push eax
lea ebx, [ebp - 0x410]
mov byte [ebp - 4], 0x1c
call fcn.004186b0
lea ecx, [ebp - 0x6b4]
push ecx
mov ecx, eax
call fcn.004061b9
lea eax, [ebp - 0x6b4]
mov byte [ebp - 4], 0x1d
call fcn.00408209
mov ecx, dword [ebp - 0x6b4]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x40a6f0
mov esi, dword [ebp - 0x690]
mov edx, dword [esi + 0x478]
mov edx, dword [edx - 0xc]
add edx, eax
cmp edx, 0x30
jg 0x409f50
push ecx
push dword [esi + 0x478]
lea eax, [ebp - 0x6a0]
push 0x45885c
push eax
call fcn.004058ae
add esp, 0x10
jmp 0x409fd7
push 0x2e
pop ecx
mov ebx, ecx
sub ebx, eax
test ebx, ebx
jle 0x409f99
push 0x45888c
lea eax, [ebp - 0x6a0]
push eax
call fcn.00402b88
mov eax, dword [esi + 0x478]
push ebx
push eax
lea eax, [ebp - 0x6a0]
call fcn.004086f2
push dword [ebp - 0x6b4]
lea ecx, [ebp - 0x6a0]
push str...._s_
call fcn.00408798
pop ecx
pop ecx
jmp 0x409fd7
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x6b4]
call fcn.0040dcc6
mov byte [ebp - 4], 0x1e
push dword [eax]
lea eax, [ebp - 0x6a0]
push 0x4588b8
push eax
call fcn.004058ae
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0x818]
add esp, 0xc
add eax, 0xfffffff0
call fcn.00402c12
push 0x458884
push 0x458888
lea eax, [ebp - 0x6a0]
push eax
call fcn.0040db21
mov eax, dword [ebp - 0x6a0]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x6dc], esp
mov ebx, esp
call fcn.00406215
add eax, 0x10
push esi
mov dword [ebx], eax
call fcn.0040d845
mov edx, dword [ebp - 0x6b4]
mov eax, dword [edx - 0xc]
lea ecx, [eax - 1]
test ecx, ecx
js 0x40a7ad
cmp ecx, eax
jg 0x40a7ad
movzx ecx, word [edx + ecx*2]
push 0x2f
pop edx
cmp dx, cx
jne 0x40a114
lea ecx, [ebp - 0x6b4]
dec eax
push ecx
call fcn.0040da99
mov eax, dword [esi + 0x478]
sub eax, 0x10
call fcn.00406215
add eax, 0x10
mov dword [ebp - 0x6f8], eax
mov byte [ebp - 4], 0x1f
push dword [ebp - 0x6b4]
lea ecx, [ebp - 0x6f8]
push 0x4588e0
call fcn.00408798
mov esi, dword [ebp - 0x6f8]
pop ecx
pop ecx
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x40a09b
cmp eax, 0xb7
jne 0x40a715
push 0xfde9
lea eax, [ebp - 0x7fc]
push eax
mov ebx, esi
call fcn.00418730
push eax
lea eax, [ebp - 0x844]
push eax
call fcn.004204d0
push eax
lea ebx, [ebp - 0x900]
call fcn.00419e80
mov edx, str.folders
lea ecx, [ebp - 0x740]
mov byte [ebp - 4], 0x20
call fcn.0041a620
mov edx, eax
mov eax, dword [ebp - 0x6a8]
call fcn.0041a440
mov edi, ebx
mov esi, eax
call fcn.0041a1f0
mov ecx, ebx
mov byte [ebp - 4], 0x1f
call fcn.0041a0c0
inc dword [ebp - 0x6a8]
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0x6f8]
add eax, 0xfffffff0
jmp 0x40a4d8
mov eax, dword [section..data]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6b0], eax
mov byte [ebp - 4], 0x21
push dword [ebp - 0x6b4]
lea eax, [ebp - 0x6b0]
push dword [esi + 0x478]
push str._s_s
push eax
call fcn.004058ae
mov eax, dword [ebp - 0x6b0]
add eax, 0xfffffff0
add esp, 0x10
mov dword [ebp - 0x704], eax
call fcn.00406215
add eax, 0x10
mov dword [ebp - 0x6c4], eax
mov byte [ebp - 4], 0x22
cmp dword [eax - 4], 1
jle 0x40a187
push dword [eax - 0xc]
lea eax, [ebp - 0x6c4]
push eax
call fcn.004029db
mov eax, dword [ebp - 0x6c4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x40a22b
lea esi, [ebp - 0x6c4]
call fcn.00408697
mov esi, dword [ebp - 0x6c4]
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x40a1c1
cmp eax, 0xb7
jne 0x40a72f
mov ebx, dword [ebp - 0x6c4]
push 0xfde9
lea eax, [ebp - 0x7fc]
push eax
call fcn.00418730
push eax
lea eax, [ebp - 0x844]
push eax
call fcn.004204d0
push eax
lea ebx, [ebp - 0x8f0]
call fcn.00419e80
mov edx, str.folders
lea ecx, [ebp - 0x740]
mov byte [ebp - 4], 0x23
call fcn.0041a620
mov edx, eax
mov eax, dword [ebp - 0x6a8]
call fcn.0041a440
mov edi, ebx
mov esi, eax
call fcn.0041a1f0
mov ecx, ebx
mov byte [ebp - 4], 0x22
call fcn.0041a0c0
mov edi, section..data
push dword [ebp - 0x69c]
call fcn.00435360
pop ecx
test eax, eax
jne 0x40a455
test byte [0x466f00], 1
jne 0x40a26c
mov eax, dword [section..data]
or dword [0x466f00], 1
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
push 0x451cab
mov dword [0x466efc], eax
call fcn.0043b915
pop ecx
and dword [ebp - 0x6c0], 0
mov ebx, 0x4588fc
push ebx
push dword [ebp - 0x6b0]
lea eax, [ebp - 0x6c0]
push eax
call fcn.0043bb41
add esp, 0xc
cmp dword [ebp - 0x6c0], 0
jne 0x40a3c3
mov eax, dword [section..data]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x7ac], eax
mov byte [ebp - 4], 0x24
push dword [ebp - 0x6b0]
lea ecx, [ebp - 0x7ac]
call fcn.0040cb43
mov esi, dword [ebp - 0x7ac]
test eax, eax
je 0x40a2f4
push esi
call fcn.0040ca16
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push dword [ebp - 0x6b0]
lea eax, [ebp - 0x6c0]
push eax
call fcn.0043bb41
add esp, 0xc
cmp dword [ebp - 0x6c0], 0
jne 0x40a3b7
push dword [ebp - 0x6b0]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40a38e
mov edi, str..old
lea eax, [ebp - 0x810]
push edi
push eax
lea ecx, [ebp - 0x6b0]
call fcn.00404e82
mov byte [ebp - 4], 0x25
push dword [ebp - 0x6b0]
mov ecx, dword [eax]
call fcn.004195b0
mov byte [ebp - 4], 0x24
mov eax, dword [ebp - 0x810]
add esp, 0xc
add eax, 0xfffffff0
call fcn.00402c12
lea eax, [ebp - 0x754]
push edi
push eax
lea ecx, [ebp - 0x6b0]
call fcn.00404e82
pop ecx
pop ecx
mov edi, 0x466efc
mov byte [ebp - 4], 0x26
call fcn.004081c8
mov byte [ebp - 4], 0x24
mov eax, dword [ebp - 0x754]
add eax, 0xfffffff0
call fcn.00402c12
mov ebx, 0x4588fc
mov edi, section..data
push ebx
push dword [ebp - 0x6b0]
lea eax, [ebp - 0x6c0]
push eax
call fcn.0043bb41
add esp, 0xc
cmp dword [ebp - 0x6c0], 0
mov dword [ebp - 0x728], eax
je 0x40a749
lea eax, [esi - 0x10]
mov byte [ebp - 4], 0x22
call fcn.00402c12
push 0x80000
call fcn.0043996d
pop ecx
mov ebx, eax
jmp 0x40a3e8
push dword [ebp - 0x6c0]
push esi
push 1
push ebx
call fcn.0043bcdf
add esp, 0x10
cmp esi, eax
jne 0x40a3fd
mov eax, dword [ebp - 0x69c]
push ebx
call fcn.00435520
mov esi, eax
pop ecx
test esi, esi
jg 0x40a3d2
jmp 0x40a404
and dword [ebp - 0x694], 0
push ebx
call fcn.00439a01
pop ecx
push dword [ebp - 0x6c0]
call fcn.0043bdc6
mov ebx, dword [ebp - 0x69c]
pop ecx
call fcn.004357b0
push dword [0x466efc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40a448
push dword [0x466efc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, 0x466efc
call fcn.00402999
cmp dword [ebp - 0x694], 0
je 0x40a7a2
mov ebx, dword [ebp - 0x6b0]
push 0xfde9
lea eax, [ebp - 0x7fc]
push eax
call fcn.00418730
push eax
lea eax, [ebp - 0x844]
push eax
call fcn.004204d0
push eax
lea ebx, [ebp - 0x920]
call fcn.00419e80
mov edx, str.files
lea ecx, [ebp - 0x740]
mov byte [ebp - 4], 0x28
call fcn.0041a620
mov edx, eax
mov eax, dword [ebp - 0x6f0]
call fcn.0041a440
mov edi, ebx
mov esi, eax
call fcn.0041a1f0
mov ecx, ebx
mov byte [ebp - 4], 0x22
call fcn.0041a0c0
mov eax, dword [ebp - 0x6c4]
inc dword [ebp - 0x6f0]
add eax, 0xfffffff0
call fcn.00402c12
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0x704]
call fcn.00402c12
mov esi, dword [ebp - 0x69c]
call fcn.00435040
mov edi, eax
mov eax, dword [ebp - 0x6b4]
add eax, 0xfffffff0
call fcn.00402c12
lea esi, [ebp - 0x7fc]
mov byte [ebp - 4], 0x16
call fcn.004185c0
xor ebx, ebx
test edi, edi
mov edi, section..data
je 0x409e64
mov eax, dword [ebp - 0x69c]
call fcn.00434a70
push dword [ebp - 0x698]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
mov eax, esp
mov dword [ebp - 0x6dc], esp
push eax
mov ecx, 0x45833c
call fcn.004061b9
mov esi, dword [ebp - 0x690]
push esi
call fcn.0040d845
cmp dword [ebp - 0x694], ebx
jne 0x40a7b7
mov edx, str.files
lea ecx, [ebp - 0x740]
call fcn.0041a620
push eax
lea ecx, [ebp - 0x888]
call fcn.00419f60
lea eax, [ebp - 0x888]
mov byte [ebp - 4], 0x29
xor esi, esi
call fcn.0041a410
test eax, eax
je 0x40a5f4
push esi
lea eax, [ebp - 0x888]
push eax
call fcn.0041a460
call fcn.00419f40
lea ecx, [ebp - 0x844]
call fcn.00420710
push 0xfde9
lea ecx, [ebp - 0x7d4]
push ecx
mov ebx, eax
call fcn.004186b0
lea ecx, [ebp - 0x77c]
push ecx
mov ecx, eax
call fcn.004061b9
push dword [ebp - 0x77c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x77c]
add eax, 0xfffffff0
call fcn.00402c12
lea eax, [ebp - 0x888]
inc esi
call fcn.0041a410
cmp esi, eax
jb 0x40a58a
xor ebx, ebx
mov edx, str.folders
lea ecx, [ebp - 0x740]
call fcn.0041a620
push eax
lea ecx, [ebp - 0x8a8]
call fcn.00419f60
lea eax, [ebp - 0x8a8]
mov byte [ebp - 4], 0x2a
xor esi, esi
call fcn.0041a410
test eax, eax
je 0x40a68d
push esi
lea eax, [ebp - 0x8a8]
push eax
call fcn.0041a460
call fcn.00419f40
lea ecx, [ebp - 0x844]
call fcn.00420710
push 0xfde9
lea ecx, [ebp - 0x7d4]
push ecx
mov ebx, eax
call fcn.004186b0
lea ecx, [ebp - 0x798]
push ecx
mov ecx, eax
call fcn.004061b9
push dword [ebp - 0x798]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [ebp - 0x798]
add eax, 0xfffffff0
call fcn.00402c12
lea eax, [ebp - 0x8a8]
inc esi
call fcn.0041a410
cmp esi, eax
jb 0x40a625
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], 0x29
call fcn.0041a0c0
lea ecx, [ebp - 0x888]
mov byte [ebp - 4], 0x16
call fcn.0041a0c0
lea esi, [ebp - 0x778]
call fcn.0040df9c
mov eax, dword [ebp - 0x6a0]
add eax, 0xfffffff0
call fcn.00402c12
lea esi, [ebp - 0x844]
call fcn.004203d0
lea ecx, [ebp - 0x740]
mov byte [ebp - 4], 4
call fcn.0041a0c0
push 8
jmp 0x409238
mov dword [ebp - 0x694], ebx
jmp 0x40a516
and dword [ebp - 0x694], 0
lea eax, [ecx - 0x10]
call fcn.00402c12
lea esi, [ebp - 0x7fc]
mov byte [ebp - 4], 0x16
call fcn.004185c0
xor ebx, ebx
jmp 0x40a516
and dword [ebp - 0x694], 0
lea eax, [esi - 0x10]
call fcn.00402c12
mov eax, dword [ebp - 0x6b4]
add eax, 0xfffffff0
jmp 0x40a6fa
and dword [ebp - 0x694], 0
lea eax, [esi - 0x10]
call fcn.00402c12
mov eax, dword [ebp - 0x6b0]
add eax, 0xfffffff0
jmp 0x40a71f
mov ebx, dword [ebp - 0x69c]
and dword [ebp - 0x694], 0
call fcn.004357b0
mov eax, dword [section..data]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x788], eax
mov byte [ebp - 4], 0x27
push dword [ebp - 0x728]
lea eax, [ebp - 0x788]
push str.touch_file_failed:__d
push eax
call fcn.004058ae
mov eax, dword [ebp - 0x788]
add esp, 0xc
add eax, 0xfffffff0
call fcn.00402c12
lea eax, [esi - 0x10]
call fcn.00402c12
mov eax, dword [ebp - 0x6c4]
add eax, 0xfffffff0
jmp 0x40a739
push 0x80070057
call fcn.00402bfa
push 0x46
mov eax, esi
call fcn.0040d75b
mov dword [ebp - 0x6ac], 1
cmp dword [esi + 0x46c], ebx
jne 0x40a7e4
cmp dword [esi + 0x12d8], 0x6d6c
jne 0x40a7e4
mov dword [ebp - 0x6ac], ebx
cmp dword [esi + 0x458], ebx
je 0x40a9c9
cmp dword [ebp - 0x6ac], ebx
je 0x40a9c9
lea eax, [ebp - 0x6a0]
push 0x458944
push eax
call fcn.004058ae
mov eax, dword [ebp - 0x6a0]
pop ecx
add eax, 0xfffffff0
mov dword [ebp - 0x6dc], esp
mov dword [ebp - 0x754], esp
call fcn.00406215
mov ecx, esp
add eax, 0x10
push esi
mov dword [ecx], eax
call fcn.0040d845
push 0x4b
mov eax, esi
call fcn.0040d75b
lea ecx, [esi + 0x1300]
mov edx, str.shortcut
call fcn.0041a620
mov edx, str.desktop
mov ecx, eax
call fcn.0041a620
mov dword [ebp - 0x6f8], eax
mov dword [ebp - 0x6a4], ebx
call fcn.0041a410
test eax, eax
je 0x40a9c9
push dword [ebp - 0x6a4]
push dword [ebp - 0x6f8]
call fcn.0041a460
mov edx, str.name
mov ecx, eax
call fcn.0041a620
call fcn.00419f40
mov esi, 0xfde9
push esi
lea ecx, [ebp - 0x7d4]
push ecx
mov ebx, eax
call fcn.004186b0
lea ecx, [ebp - 0x6fc]
push ecx
mov ecx, eax
call fcn.004061b9
mov byte [ebp - 4], 0x2b
push dword [ebp - 0x6a4]
push dword [ebp - 0x6f8]
call fcn.0041a460
mov edx, str.file
mov ecx, eax
call fcn.0041a620
call fcn.00419f40
push esi
lea ecx, [ebp - 0x7d4]
push ecx
mov ebx, eax
call fcn.004186b0
lea ecx, [ebp - 0x7a0]
push ecx
mov ecx, eax
call fcn.004061b9
mov byte [ebp - 4], 0x2c
mov eax, dword [section..data]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x750], eax
mov eax, dword [ebp - 0x690]
mov byte [ebp - 4], 0x2d
push dword [ebp - 0x7a0]
push dword [eax + 0x478]
lea eax, [ebp - 0x750]
push str._s_s
push eax
call fcn.004058ae
add esp, 0x10
push 0x458884
push 0x458888
lea eax, [ebp - 0x750]
push eax
call fcn.0040db21
mov eax, dword [ebp - 0x6fc]
cmp dword [eax - 0xc], 0
mov esi, dword [ebp - 0x750]
je 0x40a97c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40a97c
push esi
push dword [ebp - 0x6fc]
call fcn.00421820
pop ecx
pop ecx
lea eax, [esi - 0x10]
call fcn.00402c12
mov eax, dword [ebp - 0x7a0]
add eax, 0xfffffff0
call fcn.00402c12
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x6fc]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0x6f8]
inc dword [ebp - 0x6a4]
call fcn.0041a410
cmp dword [ebp - 0x6a4], eax
jb 0x40a873
mov esi, dword [ebp - 0x690]
xor ebx, ebx
push 0x55
mov eax, esi
call fcn.0040d75b
cmp dword [esi + 0x45c], ebx
je 0x40ac6a
lea eax, [ebp - 0x688]
push eax
mov dword [ebp - 0x688], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40aa0f
cmp dword [ebp - 0x678], 2
jne 0x40aa0f
cmp dword [ebp - 0x684], 0xa
je 0x40ac6a
cmp dword [ebp - 0x6ac], ebx
je 0x40ac6a
lea eax, [ebp - 0x6a0]
push 0x458984
push eax
call fcn.004058ae
mov eax, dword [ebp - 0x6a0]
pop ecx
add eax, 0xfffffff0
mov dword [ebp - 0x6dc], esp
mov esi, esp
call fcn.00406215
add eax, 0x10
mov dword [esi], eax
mov esi, dword [ebp - 0x690]
push esi
call fcn.0040d845
lea ecx, [esi + 0x1300]
mov edx, str.shortcut
call fcn.0041a620
mov edx, str.taskbar
mov ecx, eax
call fcn.0041a620
mov dword [ebp - 0x6fc], eax
mov dword [ebp - 0x6a4], ebx
call fcn.0041a410
test eax, eax
je 0x40ac6a
mov esi, 0xfde9
push dword [ebp - 0x6a4]
push dword [ebp - 0x6fc]
call fcn.0041a460
mov edx, str.name
mov ecx, eax
call fcn.0041a620
call fcn.00419f40
push esi
lea ecx, [ebp - 0x7d4]
push ecx
mov ebx, eax
call fcn.004186b0
lea ecx, [ebp - 0x724]
push ecx
mov ecx, eax
call fcn.004061b9
mov byte [ebp - 4], 0x2e
push dword [ebp - 0x6a4]
push dword [ebp - 0x6fc]
call fcn.0041a460
mov edx, str.file
mov ecx, eax
call fcn.0041a620
call fcn.00419f40
push esi
lea ecx, [ebp - 0x7d4]
push ecx
mov ebx, eax
call fcn.004186b0
lea ecx, [ebp - 0x784]
push ecx
mov ecx, eax
call fcn.004061b9
mov byte [ebp - 4], 0x2f
mov eax, dword [section..data]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x690]
mov byte [ebp - 4], 0x30
push dword [ebp - 0x784]
push dword [eax + 0x478]
lea eax, [ebp - 0x6a8]
push str._s_s
push eax
call fcn.004058ae
add esp, 0x10
push 0x458884
push 0x458888
lea eax, [ebp - 0x6a8]
push eax
call fcn.0040db21
mov eax, dword [ebp - 0x724]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
je 0x40ac1d
push dword [ebp - 0x6a8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40ac1d
push dword [ebp - 0x6a8]
push dword [ebp - 0x724]
call fcn.004213d0
pop ecx
pop ecx
call fcn.0040c822
test eax, eax
je 0x40ac1d
mov eax, dword [section..data]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6f4], eax
lea eax, [ebp - 0x81c]
push eax
mov byte [ebp - 4], 0x31
call fcn.00419b30
pop ecx
mov byte [ebp - 4], 0x32
push dword [ebp - 0x724]
push dword [eax]
lea eax, [ebp - 0x6f4]
push str._s_s.lnk
push eax
call fcn.004058ae
mov eax, dword [ebp - 0x81c]
add esp, 0x10
add eax, 0xfffffff0
call fcn.00402c12
push ebx
push ebx
push ebx
push dword [ebp - 0x6f4]
push str.taskbarpin
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x6f4]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0x6a8]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0x784]
add eax, 0xfffffff0
call fcn.00402c12
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x724]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0x6fc]
inc dword [ebp - 0x6a4]
call fcn.0041a410
cmp dword [ebp - 0x6a4], eax
jb 0x40aa8e
xor ebx, ebx
mov eax, dword [ebp - 0x690]
cmp dword [eax + 0x460], ebx
je 0x40af87
cmp dword [ebp - 0x6ac], ebx
je 0x40af87
lea eax, [ebp - 0x6a0]
push str.ck_WeR
push eax
call fcn.004058ae
mov eax, dword [ebp - 0x6a0]
pop ecx
add eax, 0xfffffff0
mov dword [ebp - 0x6dc], esp
mov esi, esp
call fcn.00406215
push dword [ebp - 0x690]
add eax, 0x10
mov dword [esi], eax
call fcn.0040d845
lea esi, [ebp - 0x75c]
call fcn.00419bb0
mov byte [ebp - 4], 0x33
mov eax, dword [section..data]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x768], eax
push 0x4572b0
mov byte [ebp - 4], 0x34
push dword [ebp - 0x75c]
lea eax, [ebp - 0x768]
push str._sThinkSky_s
push eax
call fcn.004058ae
mov eax, dword [ebp - 0x768]
add esp, 0x10
call fcn.00419050
mov eax, dword [section..data]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x760], eax
mov ecx, dword [ebp - 0x690]
add ecx, 0x1300
mov edx, str.shortcut
mov byte [ebp - 4], 0x35
call fcn.0041a620
mov edx, str.desktop
mov ecx, eax
call fcn.0041a620
mov dword [ebp - 0x6f4], eax
mov dword [ebp - 0x6a8], ebx
call fcn.0041a410
test eax, eax
je 0x40af59
mov esi, 0xfde9
push dword [ebp - 0x6a8]
push dword [ebp - 0x6f4]
call fcn.0041a460
mov edx, str.file
mov ecx, eax
call fcn.0041a620
call fcn.00419f40
push esi
lea ecx, [ebp - 0x7d4]
push ecx
mov ebx, eax
call fcn.004186b0
push eax
lea eax, [ebp - 0x760]
push eax
call fcn.00402b88
push dword [ebp - 0x6a8]
push dword [ebp - 0x6f4]
call fcn.0041a460
mov edx, str.name
mov ecx, eax
call fcn.0041a620
call fcn.00419f40
push esi
lea ecx, [ebp - 0x7d4]
push ecx
mov ebx, eax
call fcn.004186b0
lea ecx, [ebp - 0x758]
push ecx
mov ecx, eax
call fcn.004061b9
mov byte [ebp - 4], 0x36
mov eax, dword [section..data]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6bc], eax
mov eax, dword [ebp - 0x690]
mov byte [ebp - 4], 0x37
push dword [ebp - 0x760]
push dword [eax + 0x478]
lea eax, [ebp - 0x6bc]
push str._s_s
push eax
call fcn.004058ae
add esp, 0x10
push 0x458884
push 0x458888
lea eax, [ebp - 0x6bc]
push eax
call fcn.0040db21
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x6b8]
push eax
push 0x452578
push 1
push 0
push 0x452588
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x40af1a
mov eax, dword [ebp - 0x6b8]
push dword [ebp - 0x6bc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x6b8]
push dword [ebp - 0x758]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x6b8]
mov ecx, dword [eax]
lea edx, [ebp - 0x7a4]
push edx
push 0x452598
push eax
call dword [ecx]
test eax, eax
js 0x40af0e
mov eax, dword [section..data]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x728], eax
mov byte [ebp - 4], 0x38
push dword [ebp - 0x758]
lea eax, [ebp - 0x728]
push 0x4572b0
push dword [ebp - 0x75c]
push str._sThinkSky_s_s.lnk
push eax
call fcn.004058ae
mov eax, dword [ebp - 0x7a4]
mov ebx, dword [ebp - 0x728]
mov ecx, dword [eax]
add esp, 0x14
push 1
push ebx
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x7a4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 0x37
call fcn.00402c12
mov eax, dword [ebp - 0x6b8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x6bc]
add eax, 0xfffffff0
call fcn.00402c12
mov byte [ebp - 4], 0x35
mov eax, dword [ebp - 0x758]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0x6f4]
inc dword [ebp - 0x6a8]
call fcn.0041a410
cmp dword [ebp - 0x6a8], eax
jb 0x40ad67
xor ebx, ebx
mov eax, dword [ebp - 0x760]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0x768]
add eax, 0xfffffff0
call fcn.00402c12
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x75c]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [section..data]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x700], eax
mov dword [ebp - 0x46c], 0xf
mov dword [ebp - 0x470], ebx
mov byte [ebp - 0x480], bl
mov byte [ebp - 4], 0x3a
cmp dword [ebp - 0x418], 0x10
mov eax, dword [ebp - 0x42c]
jae 0x40afc9
lea eax, [ebp - 0x42c]
mov edi, dword [ebp - 0x6c8]
push eax
lea eax, [ebp - 0x480]
call fcn.00408367
mov dword [ebp - 0x890], 1
mov dword [ebp - 0x898], ebx
mov dword [ebp - 0x894], ebx
mov edx, str.mode
lea ecx, [ebp - 0x740]
mov byte [ebp - 4], 0x3b
call fcn.0041a620
lea edi, [ebp - 0x898]
mov esi, eax
call fcn.0041a1f0
mov ecx, edi
mov byte [ebp - 4], 0x3a
call fcn.0041a0c0
mov ebx, dword [ebp - 0x690]
lea ecx, [ebx + 0x1300]
mov esi, str.shortcut
mov edx, esi
mov dword [ebp - 0x68c], ecx
call fcn.0041a620
mov edx, str.setup
lea ecx, [ebp - 0x740]
mov edi, eax
call fcn.0041a620
mov edx, esi
mov ecx, eax
call fcn.0041a620
mov esi, eax
call fcn.0041a1f0
lea eax, [ebx + 0x478]
mov ebx, dword [eax]
push 0xfde9
lea ecx, [ebp - 0x7d4]
push ecx
mov dword [ebp - 0x6b8], eax
call fcn.00418730
push eax
lea eax, [ebp - 0x844]
push eax
call fcn.004204d0
push eax
lea ebx, [ebp - 0x910]
call fcn.00419e80
mov edx, str.setup
lea ecx, [ebp - 0x740]
mov byte [ebp - 4], 0x3c
call fcn.0041a620
mov edx, str.root
mov ecx, eax
call fcn.0041a620
mov edi, ebx
mov esi, eax
call fcn.0041a1f0
mov ecx, ebx
mov byte [ebp - 4], 0x3a
call fcn.0041a0c0
mov eax, dword [ebp - 0x690]
xor ebx, ebx
cmp dword [eax + 0x46c], ebx
jne 0x40b11b
mov eax, dword [eax + 0x12d8]
cdq
mov dword [ebp - 0x8b0], 1
mov dword [ebp - 0x8b8], eax
mov dword [ebp - 0x8b4], edx
mov edx, str.channel
lea ecx, [ebp - 0x740]
mov byte [ebp - 4], 0x3d
call fcn.0041a620
lea edi, [ebp - 0x8b8]
mov esi, eax
call fcn.0041a1f0
mov ecx, edi
jmp 0x40b16b
mov ecx, dword [ebp - 0x68c]
mov esi, str.channel
mov edx, esi
call fcn.0041a620
mov ecx, eax
call fcn.0041a210
cdq
mov dword [ebp - 0x870], 1
mov dword [ebp - 0x878], eax
mov dword [ebp - 0x874], edx
mov edx, esi
lea ecx, [ebp - 0x740]
mov byte [ebp - 4], 0x3e
call fcn.0041a620
lea edi, [ebp - 0x878]
mov esi, eax
call fcn.0041a1f0
mov ecx, edi
mov byte [ebp - 4], 0x3a
call fcn.0041a0c0
mov ecx, dword [ebp - 0x68c]
mov esi, str.uninstrun
mov edx, esi
call fcn.0041a890
test al, al
je 0x40b1ad
mov ecx, dword [ebp - 0x68c]
mov edx, esi
call fcn.0041a620
mov edx, esi
lea ecx, [ebp - 0x740]
mov edi, eax
call fcn.0041a620
mov esi, eax
call fcn.0041a1f0
mov dword [ebp - 0x450], 0xf
mov dword [ebp - 0x454], ebx
mov byte [ebp - 0x464], bl
lea eax, [ebp - 0x740]
push eax
lea ecx, [ebp - 0x49c]
mov byte [ebp - 4], 0x3f
call fcn.0041aba0
mov ebx, eax
lea eax, [ebp - 0x464]
mov byte [ebp - 4], 0x40
call fcn.0040e80a
push 1
xor edi, edi
lea esi, [ebp - 0x49c]
mov byte [ebp - 4], 0x3f
call fcn.0040138b
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x820]
push eax
push 4
pop edi
lea eax, [ebp - 0x480]
call fcn.00408367
cmp dword [ebp - 0x450], 0x10
mov eax, dword [ebp - 0x464]
jae 0x40b233
lea eax, [ebp - 0x464]
mov edi, dword [ebp - 0x454]
push eax
lea eax, [ebp - 0x480]
call fcn.00408367
mov eax, dword [ebp - 0x6b8]
push dword [eax]
lea eax, [ebp - 0x700]
push str._sunins000.exe
push eax
call fcn.004058ae
mov eax, dword [ebp - 0x700]
add esp, 0xc
lea esi, [ebp - 0x480]
call fcn.004189a0
test eax, eax
je 0x40b31b
xor edi, edi
push edi
push 0x80
push 3
push edi
push edi
push 0xc0000000
push dword [ebp - 0x700]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40b31b
push edi
push esi
mov dword [ebp - 0x824], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor eax, eax
push 0x3e
mov word [ebp - 0x4e0], ax
lea eax, [ebp - 0x4de]
push edi
push eax
call fcn.00438e30
add esp, 0xc
push edi
lea eax, [ebp - 0x824]
push eax
push 0x40
lea eax, [ebp - 0x4e0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40b314
mov eax, dword [ebp - 0x4a4]
push edi
push edi
add eax, 0xfffffffc
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 0x7d8]
push eax
push 4
lea eax, [ebp - 0x6c8]
push eax
push esi
mov dword [ebp - 0x7d8], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
xor edi, edi
lea esi, [ebp - 0x464]
call fcn.0040138b
push 1
lea esi, [ebp - 0x480]
mov byte [ebp - 4], 0x39
call fcn.0040138b
mov ecx, dword [ebp - 0x68c]
mov edx, str.lastrun
call fcn.0041a620
call fcn.00419f40
push 0xfde9
lea ecx, [ebp - 0x7d4]
push ecx
mov ebx, eax
call fcn.004186b0
push eax
mov eax, dword [ebp - 0x6b8]
push dword [eax]
mov eax, dword [ebp - 0x690]
add eax, 0x47c
push str._s_s
push eax
call fcn.004058ae
mov ecx, dword [ebp - 0x68c]
mov esi, str.instrun
add esp, 0x10
mov edx, esi
call fcn.0041a890
test al, al
je 0x40b3bb
mov ecx, dword [ebp - 0x68c]
mov edx, esi
call fcn.0041a620
mov esi, dword [ebp - 0x690]
add esi, 0x12f0
mov edi, eax
call fcn.0041a1f0
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x694], edi
xor ecx, ecx
mov byte [ebp - 4], 0x41
mov eax, dword [edi - 8]
inc ecx
sub ecx, dword [edi - 4]
mov edx, 0x104
sub eax, edx
or eax, ecx
jge 0x40b3fc
mov eax, edx
lea ecx, [ebp - 0x694]
call fcn.00402a6b
mov edi, dword [ebp - 0x694]
push 1
push 0x1a
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea esi, [ebp - 0x694]
call fcn.00408697
lea eax, [ebp - 0x808]
push 0x457de8
push eax
mov ecx, esi
call fcn.00404e82
pop ecx
pop ecx
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
mov eax, dword [ebp - 0x808]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
call fcn.00402c12
inc bl
je 0x40b482
mov ecx, dword [edi - 8]
xor edx, edx
inc edx
sub edx, dword [edi - 4]
mov eax, 0x104
sub ecx, eax
or ecx, edx
jge 0x40b46a
mov ecx, esi
call fcn.00402a6b
mov edi, dword [ebp - 0x694]
push 1
push 0x23
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea esi, [ebp - 0x694]
call fcn.00408697
push 0x457de8
lea eax, [ebp - 0x694]
push eax
call fcn.00408772
mov esi, dword [ebp - 0x68c]
mov edi, str.instoptions
mov edx, edi
mov ecx, esi
call fcn.0041a890
test al, al
je 0x40b60e
mov edx, edi
mov ecx, esi
call fcn.0041a620
cmp dword [eax + 8], 4
jne 0x40b60e
mov edx, edi
mov ecx, esi
call fcn.0041a620
call fcn.0041a410
test eax, eax
je 0x40b60e
and dword [ebp - 0x6bc], 0
mov edx, edi
mov ecx, esi
call fcn.0041a620
call fcn.0041a410
test eax, eax
je 0x40b60e
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6ac], eax
mov byte [ebp - 4], 0x42
push dword [ebp - 0x6bc]
mov ecx, dword [ebp - 0x68c]
mov edx, edi
call fcn.0041a620
push eax
call fcn.0041a460
call fcn.00419f40
push 0xfde9
lea ecx, [ebp - 0x7d4]
push ecx
mov ebx, eax
call fcn.004186b0
push eax
mov eax, dword [ebp - 0x6b8]
push dword [eax]
lea eax, [ebp - 0x6ac]
push str._s_s
push eax
call fcn.004058ae
push 0x44
xor esi, esi
lea eax, [ebp - 0x990]
push esi
push eax
call fcn.00438e30
add esp, 0x1c
push 0x10
lea eax, [ebp - 0x8dc]
push esi
push eax
call fcn.00438e30
mov ebx, dword [ebp - 0x6ac]
add esp, 0xc
cmp dword [ebx - 4], 1
jle 0x40b5a1
push dword [ebx - 0xc]
lea eax, [ebp - 0x6ac]
push eax
call fcn.004029db
mov ebx, dword [ebp - 0x6ac]
lea eax, [ebp - 0x8dc]
push eax
lea eax, [ebp - 0x990]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
lea esi, [ebp - 0x6ac]
call fcn.00408697
push dword [ebp - 0x8dc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x8d8]
call esi
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 0x41
call fcn.00402c12
mov ecx, dword [ebp - 0x68c]
inc dword [ebp - 0x6bc]
mov edx, edi
call fcn.0041a620
call fcn.0041a410
cmp dword [ebp - 0x6bc], eax
jb 0x40b4f5
mov ebx, dword [ebp - 0x6b8]
mov ecx, dword [ebx]
xor edi, edi
call fcn.0040d87d
mov ecx, dword [ebp - 0x694]
call fcn.0040d87d
lea esi, [ebp - 0x8c8]
call fcn.004050fc
lea eax, [ebp - 0x814]
push 0x458a9c
push eax
mov ecx, ebx
mov byte [ebp - 4], 0x43
call fcn.00404e82
mov byte [ebp - 4], 0x44
mov eax, dword [eax]
mov ecx, esi
push ecx
mov ecx, eax
call fcn.00421010
mov byte [ebp - 4], 0x43
mov eax, dword [ebp - 0x814]
add esp, 0xc
add eax, 0xfffffff0
call fcn.00402c12
lea eax, [ebp - 0x7a8]
push eax
mov ecx, str.PrivateBuild
call fcn.004061b9
mov eax, esi
push eax
lea ecx, [ebp - 0x7a8]
mov byte [ebp - 4], 0x45
call fcn.00405127
push dword [eax]
call fcn.0043b31f
mov esi, dword [ebp - 0x690]
mov dword [esi + 0x12d4], eax
mov eax, dword [ebp - 0x7a8]
pop ecx
add eax, 0xfffffff0
call fcn.00402c12
mov dword [ebp - 0x6d4], edi
mov dword [ebp - 0x6d0], edi
mov dword [ebp - 0x6cc], edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstalliToolsAVM
push connect
lea eax, [ebp - 0x6d4]
mov byte [ebp - 4], 0x46
call fcn.0040e8f3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40b7e5
push 0x4572b0
push str.DisplayName
lea eax, [ebp - 0x6d4]
push eax
call fcn.0040e84f
push dword [ebp - 0x700]
lea eax, [ebp - 0x6d4]
push str.DisplayIcon
push eax
call fcn.0040e84f
push str.http:__www.itools.cn
push str.HelpLink
lea eax, [ebp - 0x6d4]
push eax
call fcn.0040e84f
push dword [ebp - 0x700]
lea eax, [ebp - 0x6d4]
push str.UninstallString
push eax
call fcn.0040e84f
push 0x458b48
push str.Publisher
lea eax, [ebp - 0x6d4]
push eax
call fcn.0040e84f
push str.2052
push str.Lang
lea eax, [ebp - 0x6d4]
push eax
call fcn.0040e84f
cmp dword [esi + 0x46c], edi
jne 0x40b78f
mov eax, dword [esi + 0x12d8]
mov dword [ebp - 0x800], eax
lea eax, [ebp - 0x800]
jmp 0x40b7b2
mov ecx, dword [ebp - 0x68c]
mov edx, str.channel
call fcn.0041a620
mov ecx, eax
call fcn.0041a210
mov dword [ebp - 0x804], eax
lea eax, [ebp - 0x804]
push 4
push eax
push 4
push edi
push str.Channel
push dword [ebp - 0x6d4]
call ebx
cmp dword [ebp - 0x6d4], edi
je 0x40b7df
push dword [ebp - 0x6d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6d4], edi
mov dword [ebp - 0x6d0], edi
push str.SOFTWAREThinkSkyiToolsAVM
push connect
lea eax, [ebp - 0x6d4]
call fcn.0040e8f3
test eax, eax
jne 0x40b870
cmp dword [esi + 0x46c], edi
jne 0x40b81a
mov eax, dword [esi + 0x12d8]
mov dword [ebp - 0x80c], eax
lea eax, [ebp - 0x80c]
jmp 0x40b83d
mov ecx, dword [ebp - 0x68c]
mov edx, str.channel
call fcn.0041a620
mov ecx, eax
call fcn.0041a210
mov dword [ebp - 0x7dc], eax
lea eax, [ebp - 0x7dc]
push 4
push eax
push 4
push edi
push str.Channel
push dword [ebp - 0x6d4]
call ebx
cmp dword [ebp - 0x6d4], edi
je 0x40b86a
push dword [ebp - 0x6d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6d4], edi
mov dword [ebp - 0x6d0], edi
push 0x5f
mov eax, esi
call fcn.0040d75b
push 0x64
mov eax, esi
call fcn.0040d75b
push edi
push edi
cmp dword [esi + 0x464], edi
je 0x40b89d
mov eax, dword [esi]
push 0x8401
mov ecx, esi
call dword [eax + 0xe0]
jmp 0x40b8af
push 1
push edi
push edi
push 0x8401
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
cmp dword [ebp - 0x6d4], edi
je 0x40b8c3
push dword [ebp - 0x6d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x8c8]
push eax
mov byte [ebp - 4], 0x41
call fcn.00403565
mov eax, dword [ebp - 0x694]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0x700]
add eax, 0xfffffff0
call fcn.00402c12
lea esi, [ebp - 0x778]
call fcn.0040df9c
mov eax, dword [ebp - 0x6a0]
add eax, 0xfffffff0
call fcn.00402c12
lea esi, [ebp - 0x844]
call fcn.004203d0
lea ecx, [ebp - 0x740]
mov byte [ebp - 4], 4
call fcn.0041a0c0
push 1
xor edi, edi
lea esi, [ebp - 0x42c]
call fcn.0040138b
mov eax, dword [ebp - 0x70c]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0x698]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0x708]
add eax, 0xfffffff0
call fcn.00402c12
lea esi, [ebp - 0x7d4]
call fcn.004185c0
xor eax, eax
jmp 0x40b9b1
push 1
xor edi, edi
lea esi, [ebp - 0x42c]
call fcn.0040138b
mov eax, dword [ebp - 0x70c]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0x698]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0x708]
add eax, 0xfffffff0
call fcn.00402c12
lea esi, [ebp - 0x7d4]
call fcn.004185c0
xor eax, eax
inc eax
call fcn.0044d4d6
ret