Function at 0x40e807
Capabilities:
Read file via mapping
Terminate process

Disassembly:
push 0x268
mov eax, 0x4c6a70
call fcn.004ac3e5
mov eax, dword [ebp + 8]
and dword [ebp - 0x254], 0
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x270], eax
push 0x4cb7fc
lea eax, [ebp - 0x2c]
mov ebx, ecx
call fcn.00409d45
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
call fcn.0047e61e
lea edx, [ebp - 0x2c]
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0047c798
push 1
xor edi, edi
lea esi, [ebp - 0x48]
call fcn.0040a3ed
or dword [ebp - 4], 0xffffffff
push 1
lea esi, [ebp - 0x2c]
call fcn.0040a3ed
lea edi, [ebp - 0x48]
call fcn.0047e61e
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.0047c922
push 1
xor edi, edi
lea esi, [ebp - 0x48]
call fcn.0040a3ed
xor esi, esi
lea eax, [ebp - 0x170]
mov dword [ebp - method.CInstallerBase.virtual_0], vtable.CInstallerBase.0
mov dword [ebp - 0x174], esi
call fcn.0040724a
mov dword [ebp - 0xa4], esi
mov dword [ebp - method.CInstallerSE.virtual_0], vtable.CInstallerSE.0
mov edx, ebx
lea ecx, [ebp - 0x178]
mov dword [ebp - 4], 3
call fcn.0048c376
test al, al
jne 0x40e8fa
call fcn.0047c871
lea ecx, [ebp - 0x178]
mov dword [ebp - method.CInstallerSE.virtual_0], vtable.CInstallerSE.0
call fcn.0048c2f1
mov eax, esi
jmp 0x40ee18
push dword [ebp + 0xc]
mov edx, dword [ebp - 0x25c]
lea ecx, [ebp - 0x178]
call fcn.0048c4c8
cmp eax, esi
je 0x40e916
mov esi, eax
jmp 0x40e8d9
push str.Install.ini
lea eax, [ebp - 0x48]
call fcn.00409d45
push str.SEVerStorage
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 4
call fcn.00409d45
mov byte [ebp - 4], 5
push dword [ebp - 0x25c]
lea edi, [ebp - 0x178]
push dword [ebp + 0xc]
call fcn.0048c67d
mov bl, al
neg bl
sbb bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0x64]
call fcn.0040a3ed
push 1
lea esi, [ebp - 0x48]
mov byte [ebp - 4], 3
call fcn.0040a3ed
inc bl
je 0x40e977
xor esi, esi
jmp 0x40e8d9
xor ebx, ebx
xor edi, edi
inc ebx
mov dword [ebp - 0x26c], edi
mov byte [ebp - 0x255], 0
push 8
cmp dword [ebp - 0x170], ebx
jne 0x40ea48
call fcn.004a59a9
mov esi, eax
pop ecx
mov dword [ebp - 0x268], esi
mov byte [ebp - 4], 6
cmp esi, edi
je 0x40e9cd
push str.6B584AAD_4968_41b1_89B2_8FDF8419BB39
lea eax, [ebp - 0x2c]
call fcn.00409d45
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x254], ebx
call fcn.0047f04b
mov ebx, eax
jmp 0x40e9cf
xor ebx, ebx
test byte [ebp - 0x254], 1
mov byte [ebp - 4], 3
mov dword [ebp - 0x268], ebx
je 0x40e9f5
and dword [ebp - 0x254], 0xfffffffe
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.0040a3ed
cmp byte [ebx + 4], 0
jne 0x40eb2f
push str.LocalSEInstallerPreUpdatePID
push 4
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x26c], eax
cmp eax, edi
je 0x40eb2f
push 4
push edi
push edi
push 0xf001f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, edi
je 0x40eb2f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esi], eax
push esi
jmp 0x40eb29
call fcn.004a59a9
mov esi, eax
pop ecx
mov dword [ebp - 0x268], esi
mov byte [ebp - 4], 7
cmp esi, edi
je 0x40ea82
push str.6B584AAD_4968_41b1_89B2_8FDF8419BB39
lea eax, [ebp - 0x2c]
call fcn.00409d45
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x254], 2
call fcn.0047f04b
mov ebx, eax
jmp 0x40ea84
xor ebx, ebx
test byte [ebp - 0x254], 2
mov byte [ebp - 4], 3
je 0x40eaa4
and dword [ebp - 0x254], 0xfffffffd
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
call fcn.0040a3ed
mov al, byte [ebx + 4]
mov esi, ebx
mov byte [ebp - 0x25d], al
call fcn.0040ee1e
cmp byte [ebp - 0x25d], 0
mov dword [ebp - 0x268], edi
je 0x40eb2f
push str.LocalSEInstallerPreUpdatePID
push edi
mov esi, 0xf001f
push esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, edi
je 0x40eb2f
push 4
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
cmp ebx, edi
je 0x40eb2f
mov eax, dword [ebx]
cmp eax, edi
je 0x40eb2f
push eax
push edi
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
je 0x40eb28
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 0x255], 1
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 8
call fcn.004a59a9
mov esi, eax
pop ecx
mov dword [ebp - 0x25c], esi
mov byte [ebp - 4], 8
mov ebx, 0x4cc908
cmp esi, edi
je 0x40eb68
push ebx
lea eax, [ebp - 0x80]
call fcn.00409d45
or dword [ebp - 0x254], 4
push 1
lea ecx, [ebp - 0x80]
call fcn.0047f04b
jmp 0x40eb6a
xor eax, eax
test byte [ebp - 0x254], 4
mov byte [ebp - 4], 3
mov dword [ebp - 0x264], eax
je 0x40eb90
and dword [ebp - 0x254], 0xfffffffb
push 1
xor edi, edi
lea esi, [ebp - 0x80]
call fcn.0040a3ed
cmp byte [ebp - 0x255], 0
je 0x40ec38
mov dword [ebp - 0x25c], edi
mov esi, dword [ebp - 0x264]
cmp byte [esi + 4], 0
je 0x40ec38
call fcn.0040ee1e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 8
call fcn.004a59a9
mov esi, eax
pop ecx
mov dword [ebp - 0x264], esi
mov byte [ebp - 4], 9
cmp esi, edi
je 0x40ebfa
push ebx
lea eax, [ebp - 0x9c]
call fcn.00409d45
or dword [ebp - 0x254], 8
push 1
lea ecx, [ebp - 0x9c]
call fcn.0047f04b
jmp 0x40ebfc
xor eax, eax
test byte [ebp - 0x254], 8
mov byte [ebp - 4], 3
mov dword [ebp - 0x264], eax
je 0x40ec25
and dword [ebp - 0x254], 0xfffffff7
push 1
xor edi, edi
lea esi, [ebp - 0x9c]
call fcn.0040a3ed
inc dword [ebp - 0x25c]
cmp dword [ebp - 0x25c], 0xa
jl 0x40eba3
push 8
call fcn.004a59a9
mov esi, eax
pop ecx
mov dword [ebp - 0x25c], esi
mov byte [ebp - 4], 0xa
cmp esi, edi
je 0x40ec6f
push str.1EBA7FCC_5E39_4a8f_8BAC_5B66EC3AFD1B
lea eax, [ebp - 0x48]
call fcn.00409d45
or dword [ebp - 0x254], 0x10
push edi
lea ecx, [ebp - 0x48]
call fcn.0047f04b
jmp 0x40ec71
xor eax, eax
test byte [ebp - 0x254], 0x10
mov byte [ebp - 4], 3
mov ebx, eax
je 0x40ec93
and dword [ebp - 0x254], 0xffffffef
push 1
xor edi, edi
lea esi, [ebp - 0x48]
call fcn.0040a3ed
cmp byte [ebp - 0x255], 0
je 0x40ed27
and dword [ebp - 0x25c], 0
cmp byte [ebx + 4], 0
je 0x40ed27
mov esi, ebx
call fcn.0040ee1e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 8
call fcn.004a59a9
mov esi, eax
pop ecx
mov dword [ebp - 0x274], esi
mov byte [ebp - 4], 0xb
test esi, esi
je 0x40ecf4
push str.1EBA7FCC_5E39_4a8f_8BAC_5B66EC3AFD1B
lea eax, [ebp - 0x64]
call fcn.00409d45
or dword [ebp - 0x254], 0x20
push 0
lea ecx, [ebp - 0x64]
call fcn.0047f04b
jmp 0x40ecf6
xor eax, eax
test byte [ebp - 0x254], 0x20
mov byte [ebp - 4], 3
mov ebx, eax
je 0x40ed18
and dword [ebp - 0x254], 0xffffffdf
push 1
xor edi, edi
lea esi, [ebp - 0x64]
call fcn.0040a3ed
inc dword [ebp - 0x25c]
cmp dword [ebp - 0x25c], 0xa
jl 0x40eca7
mov eax, dword [ebp - 0x264]
cmp byte [eax + 4], 0
jne 0x40edfc
cmp byte [ebx + 4], 0
jne 0x40edfc
and dword [ebp - 0x24c], 0
lea eax, [ebp - 0x248]
mov dword [ebp - method.CInstallProcedureBase.virtual_0], vtable.CInstallProcedureBase.0
call fcn.0040724a
mov dword [ebp - 0x250], 0x4ccd9c
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x250]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x174]
lea edi, [ebp - 0x170]
lea esi, [ebp - 0x248]
mov dword [ebp - 0x24c], eax
call fcn.0048c251
mov eax, dword [ebp - 0x250]
lea ecx, [ebp - 0x250]
call dword [eax + 4]
mov ecx, dword [ebp - 0xa4]
push dword [ebp - 0x270]
mov eax, dword [ecx]
call dword [eax + 8]
mov esi, dword [ebp - 0x264]
call fcn.0040ee1e
mov esi, ebx
call fcn.0040ee1e
mov esi, dword [ebp - 0x268]
test esi, esi
je 0x40edd5
call fcn.0040ee1e
cmp dword [ebp - 0x26c], 0
je 0x40edea
push dword [ebp - 0x26c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0047c871
lea ecx, [ebp - 0x250]
call fcn.004077ce
jmp 0x40ee01
call fcn.0047c871
lea ecx, [ebp - 0x178]
mov dword [ebp - method.CInstallerSE.virtual_0], vtable.CInstallerSE.0
call fcn.0048c2f1
xor eax, eax
call fcn.004ac468
ret