Function at 0x449e17
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Copy file
Get common file path
Parse pe header

Disassembly:
push 0xf1c
mov eax, 0x4ad2fc
call fcn.00473d21
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push ebx
mov dword [ebp - 0xedc], edi
mov dword [ebp - 0xed8], esi
mov dword [ebp - 0xed0], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 4], ebx
call fcn.0045b784
cmp eax, 6
jb 0x449e59
call fcn.004488d2
push edi
lea ecx, [ebp - 0xe9c]
mov dword [0x4f1f10], edi
call fcn.00448058
mov byte [ebp - 4], 1
push ebx
lea eax, [ebp - 0xe9d]
push eax
lea ecx, [ebp - 0xaf4]
mov dword [ebp - 0xaf4], 0x4cb780
mov dword [ebp - 0xacc], 0x4cb720
call fcn.00403e30
mov byte [ebp - 4], 3
push 0x104
lea eax, [ebp - 0xeac]
push eax
lea ecx, [ebp - 0xaf4]
call fcn.00415e37
mov byte [ebp - 4], 4
mov ecx, dword [eax]
mov byte [eax + 4], 1
call fcn.00415ddc
push 0x104
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xeac]
call fcn.00411a7c
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xef4], esp
push 1
lea eax, [ebp - 0xe9d]
push eax
push 0x4cb558
call fcn.00411496
mov byte [ebp - 4], 5
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xec0], esp
push 1
lea eax, [ebp - 0xaf4]
push eax
call fcn.004112ff
mov byte [ebp - 4], 6
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe9c]
call fcn.00448c0a
push 0x800
lea eax, [ebp - 0xe9c]
push ebx
push 0x4f1f18
mov dword [0x4f1f14], eax
call fcn.00474cd0
add esp, 0xc
lea eax, [ebp - 0xed4]
push eax
mov dword [0x4f273c], ebx
mov dword [ebp - 0xed4], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
push esi
lea ecx, [ebp - 0xef0]
mov dword [ebp - 0xef4], ebx
call fcn.00418cb1
mov byte [ebp - 4], 7
push 0
lea eax, [ebp - 0xe9d]
mov dword [ebp - 0x970], 0x4cb730
mov dword [ebp - 0x948], 0x4cbc34
push eax
lea ecx, [ebp - 0x970]
call fcn.00403b80
mov byte [ebp - 4], 9
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0x970]
call fcn.0043aead
mov byte [ebp - 4], 0xa
mov ecx, dword [eax]
mov byte [eax + 4], 1
call fcn.00403d20
push 0
push 0
push eax
push str.debuglog
lea ecx, [ebp - 0xef0]
call fcn.00419aa5
mov byte [ebp - 0xe9e], al
mov byte [ebp - 4], 9
cmp byte [ebp - 0xec8], 0
je 0x44a00a
mov ecx, dword [ebp - 0xecc]
push dword [ecx + 0x24]
call fcn.00404ee0
mov al, byte [ebp - 0xe9e]
test al, al
je 0x44a094
call fcn.004029a0
push 0
call fcn.00402a90
cmp dword [ebp - 0x95c], 0
lea eax, [ebp - 0x940]
push eax
je 0x44a070
lea ecx, [ebp - 0x970]
call fcn.00449bff
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x940]
call fcn.00401ac0
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xec0], esp
push 1
lea eax, [ebp - 0x970]
push eax
call fcn.00403f40
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 9
call fcn.004029b0
jmp 0x44a094
call fcn.00402aa0
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x970]
call fcn.00402b50
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x940]
call fcn.00401ac0
push 1
lea eax, [ebp - 0xe9d]
push eax
push esi
lea ecx, [ebp - 0x940]
call fcn.00402ca0
mov byte [ebp - 4], 0x10
add eax, 4
cmp dword [eax + 0x14], 8
jb 0x44a0b8
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xeb4]
push str.InstallShield_setup.exe__Unicode__started__cmdline:__s
push eax
mov dword [ebp - 0xeb4], str.Setup.cpp
mov dword [ebp - 0xeb0], 0xa0
call fcn.004191b5
add esp, 0xc
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x940]
call fcn.00401ac0
push 1
push 1
push 0
push str.runfromtemp
lea ecx, [ebp - 0xef0]
call fcn.00419aa5
mov byte [ebp - 0xebc], al
xor eax, eax
push eax
push eax
push eax
push str.reboot
lea ecx, [ebp - 0xef0]
call fcn.00419aa5
test al, al
je 0x44a27f
cmp byte [0x4ee41c], 0
jne 0x44a13b
cmp byte [0x4f3b10], 0
je 0x44a1ab
push 1
lea eax, [ebp - 0xe9d]
push eax
push str.Setup.cpp
lea ecx, [ebp - 0xa00]
call fcn.00402ca0
mov byte [ebp - 4], 0x12
push 1
lea eax, [ebp - 0xe9d]
push eax
push str.Running_after_reboot
lea ecx, [ebp - 0x940]
call fcn.00402ca0
mov byte [ebp - 4], 0x13
push 0xac
lea eax, [ebp - 0xa00]
push eax
lea eax, [ebp - 0x940]
push eax
call fcn.00402940
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x940]
call fcn.00401ac0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa00]
call fcn.00401ac0
lea eax, [ebp - 0x940]
push eax
call fcn.00424526
pop ecx
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebp - 0xa94]
call fcn.004239ac
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x940]
call fcn.00401b80
lea ecx, [ebp - 0xa94]
call fcn.00424c0c
test eax, eax
jne 0x44a21e
mov esi, dword [0x4f273c]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa94]
call fcn.00423d9d
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x970]
call fcn.00401ac0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xef0]
call fcn.00418e14
jmp 0x44b708
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xedc], esp
push 1
lea eax, [ebp - 0xe9d]
push eax
push esi
call fcn.00402ca0
mov byte [ebp - 4], 0x1c
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xa94]
call fcn.0042532e
mov esi, eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa94]
call fcn.00423d9d
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x970]
call fcn.00401ac0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xef0]
call fcn.00418e14
jmp 0x44b708
cmp byte [ebp - 0xebc], 0
je 0x44a2a5
xor eax, eax
push eax
push eax
push eax
push 0x4bb014
lea ecx, [ebp - 0xef0]
call fcn.00419aa5
test al, al
je 0x44a42a
push 0
lea eax, [ebp - 0xe9d]
push eax
lea ecx, [ebp - 0xac4]
mov dword [ebp - 0xac4], 0x4cb730
mov dword [ebp - 0xa9c], 0x4cbc34
call fcn.00403b80
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0xecc]
push eax
lea ecx, [ebp - 0xac4]
call fcn.0043aead
mov byte [ebp - 4], 0x21
mov ecx, dword [eax]
mov byte [eax + 4], 1
call fcn.00403d20
push 1
push 0
push eax
push str.removeasmajorupgrade
lea ecx, [ebp - 0xef0]
call fcn.00419aa5
mov byte [ebp - 0xe9d], al
mov byte [ebp - 4], 0x20
cmp byte [ebp - 0xec8], 0
je 0x44a32e
mov ecx, dword [ebp - 0xecc]
push dword [ecx + 0x24]
call fcn.00404ee0
mov al, byte [ebp - 0xe9d]
test al, al
je 0x44a41b
cmp byte [0x4ee41c], 0
jne 0x44a348
cmp byte [0x4f3b10], 0
je 0x44a3b8
push 1
lea eax, [ebp - 0xe9d]
push eax
push str.Setup.cpp
lea ecx, [ebp - 0xa00]
call fcn.00402ca0
mov byte [ebp - 4], 0x23
push 1
lea eax, [ebp - 0xe9d]
push eax
push 0x4bb018
lea ecx, [ebp - 0x940]
call fcn.00402ca0
mov byte [ebp - 4], 0x24
push 0xbb
lea eax, [ebp - 0xa00]
push eax
lea eax, [ebp - 0x940]
push eax
call fcn.00402940
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x940]
call fcn.00401ac0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xa00]
call fcn.00401ac0
push dword [ebp - 0xebc]
lea eax, [ebp - 0xac4]
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xedc], esp
push 1
push eax
call fcn.00403f40
mov byte [ebp - 4], 0x27
mov byte [ebp - 4], 0x20
call fcn.00448544
add esp, 0x34
mov esi, eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xac4]
call fcn.00401ac0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x970]
call fcn.00401ac0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xef0]
call fcn.00418e14
jmp 0x44b708
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xac4]
call fcn.00401ac0
cmp dword [ebp - 0xed4], 1
push 0x2d
pop edx
push 0x2f
pop ecx
jbe 0x44a6a7
movzx eax, word [esi]
cmp ax, dx
je 0x44a44e
cmp ax, cx
jne 0x44a4f5
cmp word [esi + 2], 0x25
jne 0x44a4f5
add esi, 4
mov ax, word [esi]
lea esi, [esi + 2]
cmp ax, cx
jne 0x44a45c
xor eax, eax
mov word [esi - 4], ax
cmp dword [0x4f1e98], 8
lea eax, [esi - 2]
push eax
mov ecx, 0x4f1e84
cmovae ecx, dword [0x4f1e84]
push ecx
lea eax, [ebp - 0x850]
push str._s__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x850]
push 1
push eax
call fcn.0045040b
lea ecx, [ebp - 0xeb8]
call fcn.00411784
mov byte [ebp - 4], 0x2c
push edi
lea ecx, [ebp - 0xeb8]
call fcn.0041208e
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xeb8]
call fcn.00411a75
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x970]
call fcn.00401ac0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xef0]
call fcn.00418e14
jmp 0x44b664
cmp ax, dx
je 0x44a4ff
cmp ax, cx
jne 0x44a51b
movzx ecx, word [esi + 2]
push 0x6b
pop edi
cmp cx, di
je 0x44a640
cmp ecx, 0x4b
je 0x44a640
push 0x2f
pop ecx
cmp ax, dx
je 0x44a529
cmp ax, cx
jne 0x44a6a7
movzx eax, word [esi + 2]
cmp eax, 0x67
je 0x44a53b
cmp eax, 0x47
jne 0x44a6a7
lea edi, [esi + 4]
mov ax, word [edi]
lea edi, [edi + 2]
cmp ax, cx
jne 0x44a53e
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x238], ax
lea eax, [ebp - 0x236]
push eax
call fcn.00474cd0
add esp, 0xc
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x238]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
movzx ecx, word [ebp + eax*2 - 0x23c]
push 0x2d
pop edx
xor ebx, ebx
cmp cx, dx
je 0x44a59f
push 0x2f
pop edx
cmp cx, dx
jne 0x44a5cc
movzx ecx, word [ebp + eax*2 - 0x23a]
cmp ecx, 0x73
je 0x44a5b1
cmp ecx, 0x53
jne 0x44a5cc
xor ebx, ebx
lea eax, [eax*2 - 4]
inc ebx
cmp eax, 0x208
jae 0x44a63b
xor ecx, ecx
mov word [ebp + eax - 0x238], cx
xor eax, eax
push 0x206
push eax
mov word [edi - 4], ax
mov word [ebp - 0x440], ax
lea eax, [ebp - 0x43e]
push eax
call fcn.00474cd0
add esp, 0xc
lea eax, [esi + 6]
push eax
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x440]
push eax
call fcn.0044f32a
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x970]
call fcn.00401ac0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xef0]
call fcn.00418e14
jmp 0x44b708
call fcn.00475e4b
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x648], ax
lea eax, [ebp - 0x646]
push eax
add esi, 4
call fcn.00474cd0
push esi
push dword [ebx]
lea eax, [ebp - 0x648]
push 0x4b6188
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea eax, [ebp - 0x648]
push 1
push eax
call fcn.004502d7
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x970]
call fcn.00401ac0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xef0]
call fcn.00418e14
jmp 0x44b664
xor edi, edi
cmp dword [ebp - 0xed4], 1
mov dword [ebp - 0xef8], edi
jbe 0x44a6e5
movzx eax, word [esi]
cmp ax, dx
je 0x44a6c5
cmp ax, cx
jne 0x44a6e5
movzx eax, word [esi + 2]
push 0x71
pop ecx
cmp ax, cx
je 0x44a6d9
push 0x51
pop ecx
cmp ax, cx
jne 0x44a6e5
mov edi, dword [ebx + 4]
add edi, 4
mov dword [ebp - 0xef8], edi
push 0
lea eax, [ebp - 0xe9d]
push eax
lea ecx, [ebp - 0x8e0]
mov dword [ebp - 0x8e0], 0x4cb780
mov dword [ebp - 0x8b8], 0x4cb720
call fcn.00403e30
mov byte [ebp - 4], 0x34
push 1
lea ecx, [ebp - 0xf24]
call fcn.00447fa6
mov byte [ebp - 4], 0x35
lea eax, [ebp - 0xeb4]
push eax
lea ecx, [ebp - 0xf24]
call fcn.00448521
mov eax, dword [eax]
push 0
push 0
add eax, 0x10
push eax
push str.tempdisk1folder
lea ecx, [ebp - 0xef0]
call fcn.00419aa5
test al, al
je 0x44a783
lea ecx, [ebp - 0xf24]
call fcn.00449d4f
cmp dword [ebp - 0xf14], 0
mov eax, 0x4cb558
mov ecx, eax
cmovne ecx, dword [ebp - 0xf14]
test ecx, ecx
cmovne eax, ecx
push eax
lea ecx, [ebp - 0x8dc]
call fcn.00406360
cmp dword [ebp - 0x8cc], 0
jne 0x44a86b
push 0x104
lea eax, [ebp - 0xeac]
push eax
lea ecx, [ebp - 0x8e0]
call fcn.00415e37
mov byte [ebp - 4], 0x36
mov ecx, dword [eax]
mov byte [eax + 4], 1
call fcn.00415ddc
push dword [eax]
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0xeac]
call fcn.00411a7c
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xec0], esp
push 1
lea eax, [ebp - 0xe9d]
push eax
push 0x4cb558
call fcn.00411496
mov byte [ebp - 4], 0x37
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xeb0], esp
push 1
lea eax, [ebp - 0xe9d]
push eax
push 0x4cb558
call fcn.00411496
mov byte [ebp - 4], 0x38
push 0
lea eax, [ebp - 0x940]
push eax
mov byte [ebp - 4], 0x35
call fcn.0045b033
add esp, 0x68
mov byte [ebp - 4], 0x39
push eax
lea ecx, [ebp - 0x8e0]
call fcn.00411b2a
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x940]
call fcn.00401b80
lea eax, [ebp - 0x940]
push eax
lea ecx, [ebp - 0x8e0]
call fcn.00416653
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x940]
call fcn.00401b80
lea eax, [ebp - 0x940]
push eax
lea ecx, [ebp - 0x8e0]
call fcn.0041d408
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x940]
call fcn.00401b80
cmp dword [ebp - 0x8c8], 8
lea eax, [ebp - 0x8dc]
cmovae eax, dword [ebp - 0x8dc]
push eax
push 0x4f1f18
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0xeb0], esp
push 1
lea eax, [ebp - 0x8e0]
push eax
call fcn.004112ff
mov byte [ebp - 4], 0x3d
mov byte [ebp - 4], 0x35
mov ecx, dword [0x4f1f14]
call fcn.004490e0
test edi, edi
je 0x44a8eb
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x44b43f
cmp byte [ebp - 0xebc], 0
jne 0x44a912
push dword [ebx]
call fcn.0044f562
test eax, eax
je 0x44b43f
push esi
call fcn.00449113
pop ecx
test al, al
je 0x44b43f
push 1
lea eax, [ebp - 0xe9d]
push eax
push dword [ebx]
lea ecx, [ebp - 0x880]
call fcn.00411496
mov byte [ebp - 4], 0x3e
push 0
lea ecx, [ebp - 0xa00]
push ecx
mov ecx, eax
call fcn.0041654f
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x880]
call fcn.00401b80
push 0
lea eax, [ebp - 0x940]
push eax
lea ecx, [ebp - 0xa00]
call fcn.0041654f
mov byte [ebp - 4], 0x42
push 1
lea eax, [ebp - 0xe9d]
push eax
push dword [ebx]
lea ecx, [ebp - 0x880]
call fcn.00411496
mov byte [ebp - 4], 0x43
xor ebx, ebx
push ebx
push ebx
lea ecx, [ebp - 0x9d0]
push ecx
mov ecx, eax
call fcn.00416103
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x880]
call fcn.00401b80
cmp dword [ebp - 0x9bc], ebx
jne 0x44aa5a
push ebx
lea eax, [ebp - 0xe9d]
push eax
lea ecx, [ebp - 0x880]
mov dword [ebp - 0x880], 0x4cb780
mov dword [ebp - 0x858], 0x4cb720
call fcn.00403e30
mov byte [ebp - 4], 0x48
push 0x104
lea eax, [ebp - 0xeac]
push eax
lea ecx, [ebp - 0x880]
call fcn.00415e37
mov byte [ebp - 4], 0x49
mov ecx, dword [eax]
mov byte [eax + 4], 1
call fcn.00415ddc
push 0x104
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0xeac]
call fcn.00411a7c
push ebx
push ebx
lea eax, [ebp - 0x9a0]
push eax
lea ecx, [ebp - 0x880]
call fcn.00416103
mov byte [ebp - 4], 0x4a
push eax
lea ecx, [ebp - 0x9d0]
call fcn.00411b2a
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x9a0]
call fcn.00401b80
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x880]
call fcn.00401b80
lea ecx, [ebp - 0xecc]
call fcn.00411784
mov byte [ebp - 4], 0x4d
lea eax, [ebp - 0xa00]
push eax
lea eax, [ebp - 0x910]
push eax
lea ecx, [ebp - 0x9d0]
call fcn.0042006d
mov byte [ebp - 4], 0x4e
lea eax, [ebp - 0x940]
push eax
lea eax, [ebp - 0x8b0]
push eax
lea ecx, [ebp - 0x8e0]
call fcn.0042006d
mov byte [ebp - 4], 0x4f
cmp dword [ebp - 0x898], 8
lea ecx, [ebp - 0x8ac]
cmovae ecx, dword [ebp - 0x8ac]
cmp dword [ebp - 0x8f8], 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0x90c]
cmovae eax, dword [ebp - 0x90c]
push ecx
push eax
call ebx
push 0x104
lea eax, [ebp - 0xeac]
push eax
lea ecx, [ebp - 0x8b0]
call fcn.00415e37
mov byte [ebp - 4], 0x50
mov ecx, dword [eax]
mov byte [eax + 4], 1
call fcn.00415ddc
push dword [eax]
lea ecx, [ebp - 0xecc]
call fcn.00413ada
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0xeac]
call fcn.00411a7c
push 1
lea eax, [ebp - 0xe9d]
push eax
push dword [0x4ec76c]
lea ecx, [ebp - 0x880]
call fcn.00411496
push 0x51
pop eax
mov byte [ebp - 4], al
lea eax, [ebp - 0x880]
push eax
lea eax, [ebp - 0x9a0]
push eax
lea ecx, [ebp - 0x9d0]
call fcn.0042006d
mov byte [ebp - 4], 0x52
push eax
lea ecx, [ebp - 0x910]
call fcn.00411b2a
push 0x51
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x9a0]
call fcn.00401b80
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x880]
call fcn.00401b80
push 1
lea eax, [ebp - 0xe9d]
push eax
push dword [0x4ec76c]
lea ecx, [ebp - 0x880]
call fcn.00411496
mov byte [ebp - 4], 0x55
lea eax, [ebp - 0x880]
push eax
lea eax, [ebp - 0x9a0]
push eax
lea ecx, [ebp - 0x8e0]
call fcn.0042006d
mov byte [ebp - 4], 0x56
push eax
lea ecx, [ebp - 0x8b0]
call fcn.00411b2a
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x9a0]
call fcn.00401b80
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x880]
call fcn.00401b80
cmp dword [ebp - 0x898], 8
lea ecx, [ebp - 0x8ac]
cmovae ecx, dword [ebp - 0x8ac]
cmp dword [ebp - 0x8f8], 8
push 0
lea eax, [ebp - 0x90c]
cmovae eax, dword [ebp - 0x90c]
push ecx
push eax
call ebx
push 0x104
lea eax, [ebp - 0xeac]
push eax
lea ecx, [ebp - 0x8b0]
call fcn.00415e37
mov byte [ebp - 4], 0x59
mov ecx, dword [eax]
mov byte [eax + 4], 1
call fcn.00415ddc
push dword [eax]
lea ecx, [ebp - 0xecc]
call fcn.00413ada
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0xeac]
call fcn.00411a7c
push 1
lea eax, [ebp - 0xe9d]
push eax
push str.ISSetup.dll
lea ecx, [ebp - 0x880]
call fcn.00411380
mov byte [ebp - 4], 0x5a
lea eax, [ebp - 0x880]
push eax
lea eax, [ebp - 0x9a0]
push eax
lea ecx, [ebp - 0x9d0]
call fcn.0042006d
mov byte [ebp - 4], 0x5b
push eax
lea ecx, [ebp - 0x910]
call fcn.00411b2a
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x9a0]
call fcn.00401b80
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x880]
call fcn.00401b80
push 1
lea eax, [ebp - 0xe9d]
push eax
push 0x4b66a4
lea ecx, [ebp - 0x880]
call fcn.00411496
mov byte [ebp - 4], 0x5e
lea eax, [ebp - 0x880]
push eax
lea eax, [ebp - 0x9a0]
push eax
lea ecx, [ebp - 0x8e0]
call fcn.0042006d
mov byte [ebp - 4], 0x5f
push eax
lea ecx, [ebp - 0x8b0]
call fcn.00411b2a
mov byte [ebp - 4], 0x5e
lea ecx, [ebp - 0x9a0]
call fcn.00401b80
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x880]
call fcn.00401b80
cmp dword [ebp - 0x898], 8
lea ecx, [ebp - 0x8ac]
cmovae ecx, dword [ebp - 0x8ac]
cmp dword [ebp - 0x8f8], 8
push 0
lea eax, [ebp - 0x90c]
cmovae eax, dword [ebp - 0x90c]
push ecx
push eax
call ebx
push 0x104
lea eax, [ebp - 0xeac]
push eax
lea ecx, [ebp - 0x8b0]
call fcn.00415e37
mov byte [ebp - 4], 0x62
mov ecx, dword [eax]
mov byte [eax + 4], 1
call fcn.00415ddc
push dword [eax]
lea ecx, [ebp - 0xecc]
call fcn.00413ada
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0xeac]
call fcn.00411a7c
push 0
lea eax, [ebp - 0xe9d]
push eax
lea ecx, [ebp - 0xa30]
mov dword [ebp - 0xa30], 0x4cb780
mov dword [ebp - 0xa08], 0x4cb720
call fcn.00403e30
mov byte [ebp - 4], 0x64
push 0x104
lea eax, [ebp - 0xeac]
push eax
lea ecx, [ebp - 0xa30]
call fcn.00415e37
mov byte [ebp - 4], 0x65
mov ecx, dword [eax]
mov byte [eax + 4], 1
call fcn.00415ddc
push 0x104
push dword [eax]
push str.Skin
push str.Startup
call fcn.0044e7c5
add esp, 0x10
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0xeac]
call fcn.00411a7c
cmp dword [ebp - 0xa1c], 0
jne 0x44ae21
push str.setup.isn
lea ecx, [ebp - 0xa2c]
call fcn.00406360
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x880]
push eax
lea ecx, [ebp - 0x9d0]
call fcn.0042006d
mov byte [ebp - 4], 0x66
push eax
lea ecx, [ebp - 0x910]
call fcn.00411b2a
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0x880]
call fcn.00401b80
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x880]
push eax
lea ecx, [ebp - 0x8e0]
call fcn.0042006d
mov byte [ebp - 4], 0x68
push eax
lea ecx, [ebp - 0x8b0]
call fcn.00411b2a
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0x880]
call fcn.00401b80
cmp dword [ebp - 0x898], 8
lea ecx, [ebp - 0x8ac]
cmovae ecx, dword [ebp - 0x8ac]
cmp dword [ebp - 0x8f8], 8
push 0
lea eax, [ebp - 0x90c]
cmovae eax, dword [ebp - 0x90c]
push ecx
push eax
call ebx
test eax, eax
je 0x44af05
push 0x104
lea eax, [ebp - 0xeac]
push eax
lea ecx, [ebp - 0x8b0]
call fcn.00415e37
mov byte [ebp - 4], 0x6a
mov ecx, dword [eax]
mov byte [eax + 4], 1
call fcn.00415ddc
push dword [eax]
lea ecx, [ebp - 0xecc]
call fcn.00413ada
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0xeac]
call fcn.00411a7c
push 0x10
lea eax, [ebp - 0x30]
push eax
push str.count
push str.Languages
call fcn.0044e7c5
push 0xa
lea eax, [ebp - 0x30]
push 0
push eax
call fcn.0047589d
and dword [ebp - 0xebc], 0
add esp, 0x1c
mov dword [ebp - 0xec0], eax
test eax, eax
je 0x44b139
mov esi, dword [ebp - 0xebc]
mov edi, eax
push esi
lea eax, [ebp - 0x990]
push str.key_d
push eax
call fcn.00477201
push 0x10
lea eax, [ebp - 0x870]
push eax
lea eax, [ebp - 0x990]
push eax
push str.Languages
call fcn.0044e7c5
push 0x10
lea eax, [ebp - 0x870]
push 0
push eax
call fcn.0047589d
mov ebx, eax
add esp, 0x28
test ebx, ebx
je 0x44b124
cmp dword [ebp - 0x9b8], 8
lea ecx, [ebp - 0x9cc]
cmovae ecx, dword [ebp - 0x9cc]
push ebx
push ecx
lea eax, [ebp - 0x910]
push str._s0x_04x.ini
push eax
call fcn.00420ffd
cmp dword [ebp - 0x8c8], 8
lea eax, [ebp - 0x8dc]
cmovae eax, dword [ebp - 0x8dc]
push ebx
push eax
lea eax, [ebp - 0x8b0]
push str._s0x_04x.ini
push eax
call fcn.00420ffd
add esp, 0x20
cmp dword [ebp - 0x898], 8
lea ecx, [ebp - 0x8ac]
cmovae ecx, dword [ebp - 0x8ac]
cmp dword [ebp - 0x8f8], 8
push 0
lea eax, [ebp - 0x90c]
cmovae eax, dword [ebp - 0x90c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x44b05b
push 0x104
lea eax, [ebp - 0xeac]
push eax
lea ecx, [ebp - 0x8b0]
call fcn.00415e37
push 0x6b
pop ecx
mov byte [ebp - 4], cl
mov ecx, dword [eax]
mov byte [eax + 4], 1
call fcn.00415ddc
push dword [eax]
lea ecx, [ebp - 0xecc]
call fcn.00413ada
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0xeac]
call fcn.00411a7c
cmp dword [ebp - 0x9b8], 8
lea eax, [ebp - 0x9cc]
cmovae eax, dword [ebp - 0x9cc]
push ebx
push eax
lea eax, [ebp - 0x910]
push str._s_04x.mst
push eax
call fcn.00420ffd
cmp dword [ebp - 0x8c8], 8
lea eax, [ebp - 0x8dc]
cmovae eax, dword [ebp - 0x8dc]
push ebx
push eax
lea eax, [ebp - 0x8b0]
push str._s_04x.mst
push eax
call fcn.00420ffd
add esp, 0x20
cmp dword [ebp - 0x898], 8
lea ecx, [ebp - 0x8ac]
cmovae ecx, dword [ebp - 0x8ac]
cmp dword [ebp - 0x8f8], 8
push 0
lea eax, [ebp - 0x90c]
cmovae eax, dword [ebp - 0x90c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x44b124
push 0x104
lea eax, [ebp - 0xeb8]
push eax
lea ecx, [ebp - 0x8b0]
call fcn.00415e37
mov byte [ebp - 4], 0x6c
mov ecx, dword [eax]
mov byte [eax + 4], 1
call fcn.00415ddc
push dword [eax]
lea ecx, [ebp - 0xecc]
call fcn.00413ada
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0xeb8]
call fcn.00411a7c
inc esi
cmp esi, edi
jb 0x44af47
mov esi, dword [ebp - 0xed8]
mov edi, dword [ebp - 0xef8]
push 0
lea eax, [ebp - 0xe9d]
push eax
lea ecx, [ebp - 0xa60]
mov dword [ebp - 0xa60], 0x4cb780
mov dword [ebp - 0xa38], 0x4cb720
call fcn.00403e30
mov byte [ebp - 4], 0x6e
push 1
lea eax, [ebp - 0xe9d]
push eax
push esi
lea ecx, [ebp - 0xa90]
call fcn.00411496
mov esi, eax
mov byte [ebp - 4], 0x6f
push 1
lea eax, [ebp - 0xe9d]
push eax
push 0x4f1f18
lea ecx, [ebp - 0xb24]
call fcn.00411496
mov ebx, eax
mov byte [ebp - 4], 0x70
lea eax, [ebp - 0xa00]
push eax
lea eax, [ebp - 0x9a0]
push eax
lea ecx, [ebp - 0x9d0]
call fcn.0042006d
mov dword [ebp - 0xed8], eax
push 0x71
pop eax
mov byte [ebp - 4], al
lea eax, [ebp - 0x940]
push eax
lea eax, [ebp - 0x880]
push eax
lea ecx, [ebp - 0x8e0]
call fcn.0042006d
mov byte [ebp - 4], 0x72
add esi, 4
cmp dword [esi + 0x14], 8
jb 0x44b1ec
mov esi, dword [esi]
lea edx, [ebx + 4]
push 8
pop ebx
cmp dword [edx + 0x14], ebx
jb 0x44b1f9
mov edx, dword [edx]
mov ecx, dword [ebp - 0xed8]
add ecx, 4
cmp dword [ecx + 0x14], ebx
jb 0x44b209
mov ecx, dword [ecx]
add eax, 4
cmp dword [eax + 0x14], ebx
jb 0x44b213
mov eax, dword [eax]
push esi
push edx
push ecx
push eax
lea eax, [ebp - 0xa60]
push str._s__q__s___tempdisk1folder__s___s
push eax
call fcn.00420ffd
add esp, 0x18
push 0x71
pop eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x880]
call fcn.00401b80
mov byte [ebp - 4], 0x70
lea ecx, [ebp - 0x9a0]
call fcn.00401b80
mov byte [ebp - 4], 0x6f
lea ecx, [ebp - 0xb24]
call fcn.00401b80
mov byte [ebp - 4], 0x6e
lea ecx, [ebp - 0xa90]
call fcn.00401b80
cmp byte [0x4ee41c], 0
jne 0x44b27b
cmp byte [0x4f3b10], 0
je 0x44b2eb
push 1
lea eax, [ebp - 0xe9d]
push eax
push str.Setup.cpp
lea ecx, [ebp - 0x9a0]
call fcn.00402ca0
mov byte [ebp - 4], 0x77
push 1
lea eax, [ebp - 0xe9d]
push eax
push str.Relaunching_setup_from_temp
lea ecx, [ebp - 0x880]
call fcn.00402ca0
mov byte [ebp - 4], 0x78
push 0x192
lea eax, [ebp - 0x9a0]
push eax
lea eax, [ebp - 0x880]
push eax
call fcn.00402940
mov byte [ebp - 4], 0x77
lea ecx, [ebp - 0x880]
call fcn.00401ac0
mov byte [ebp - 4], 0x6e
lea ecx, [ebp - 0x9a0]
call fcn.00401ac0
cmp dword [ebp - 0xa48], ebx
lea eax, [ebp - 0xa5c]
cmovae eax, dword [ebp - 0xa5c]
push 1
push eax
call fcn.004502d7
test eax, eax
je 0x44b3c7
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0xa60]
call fcn.00401b80
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0xa30]
call fcn.00401b80
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x8b0]
call fcn.00401b80
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x910]
call fcn.00401b80
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0xecc]
call fcn.00411a75
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x9d0]
call fcn.00401b80
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x940]
call fcn.00401b80
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0xa00]
call fcn.00401b80
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0xf24]
call fcn.0041ddde
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x8e0]
call fcn.00401b80
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x970]
call fcn.00401ac0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xef0]
call fcn.00418e14
jmp 0x44b664
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0xa60]
call fcn.00401b80
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0xa30]
call fcn.00401b80
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x8b0]
call fcn.00401b80
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x910]
call fcn.00401b80
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0xecc]
call fcn.00411a75
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x9d0]
call fcn.00401b80
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x940]
call fcn.00401b80
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0xa00]
call fcn.00401b80
call fcn.00450168
lea ecx, [ebp - 0xf08]
call fcn.004285b9
mov byte [ebp - 4], 0x8c
cmp byte [ebp - 0xe9e], 0
je 0x44b497
push 0
lea eax, [ebp - 0x970]
push eax
lea ecx, [ebp - 0x880]
mov dword [ebp - 0x880], 0x4cb730
mov dword [ebp - 0x858], 0x4cbc34
call fcn.00404e20
mov byte [ebp - 4], 0x8c
lea eax, [ebp - 0x880]
mov byte [ebp - 4], 0x8e
xor ebx, ebx
inc ebx
jmp 0x44b4ba
push 1
lea eax, [ebp - 0xe9d]
push eax
push 0x4cb558
lea ecx, [ebp - 0xa90]
call fcn.00402ca0
mov dword [ebp - 4], 0x8f
push 2
pop ebx
lea ecx, [ebp - 0xe9c]
push ecx
sub esp, 0x30
mov dword [ebp - 0xed0], ebx
mov ecx, esp
mov dword [ebp - 0xeb0], esp
push 1
push eax
call fcn.00403f40
mov dword [ebp - 4], 0x90
push edi
push dword [ebp - 0xef4]
push dword [ebp - 0xed4]
push dword [ebp - 0xedc]
mov byte [ebp - 4], 0x8f
lea ecx, [ebp - 0xf08]
call fcn.00428ef4
mov esi, eax
mov eax, 0x8e
mov dword [ebp - 4], eax
test bl, 2
je 0x44b529
and ebx, 0xfffffffd
mov dword [ebp - 0xed0], ebx
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xa90]
call fcn.00401ac0
mov dword [ebp - 4], 0x8c
test bl, 1
je 0x44b54d
and ebx, 0xfffffffe
mov dword [ebp - 0xed0], ebx
mov byte [ebp - 4], 0x8c
lea ecx, [ebp - 0x880]
call fcn.00401ac0
test esi, esi
je 0x44b689
xor ebx, ebx
push ebx
lea eax, [ebp - 0xe9d]
push eax
lea ecx, [ebp - 0x880]
mov dword [ebp - 0x880], 0x4cb730
mov dword [ebp - 0x858], 0x4cbc34
call fcn.00403b80
mov byte [ebp - 4], 0x94
lea eax, [ebp - 0xeb8]
push eax
lea ecx, [ebp - 0x880]
call fcn.0043aead
mov byte [ebp - 4], 0x95
mov ecx, dword [eax]
mov byte [eax + 4], 1
call fcn.00403d20
push ebx
push ebx
push eax
push str.runprerequisites
lea ecx, [ebp - 0xef0]
call fcn.00419aa5
mov bl, al
mov byte [ebp - 4], 0x94
cmp byte [ebp - 0xeb4], 0
je 0x44b5d3
mov ecx, dword [ebp - 0xeb8]
push dword [ecx + 0x24]
call fcn.00404ee0
test bl, bl
je 0x44b66f
lea ecx, [ebp - 0xeac]
call fcn.00411784
mov byte [ebp - 4], 0x97
push dword [0x4f1f10]
lea ecx, [ebp - 0xeac]
call fcn.0041208e
mov byte [ebp - 4], 0x94
lea ecx, [ebp - 0xeac]
call fcn.00411a75
mov byte [ebp - 4], 0x8c
lea ecx, [ebp - 0x880]
call fcn.00401ac0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0xf08]
call fcn.00428605
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0xf24]
call fcn.0041ddde
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x8e0]
call fcn.00401b80
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x970]
call fcn.00401ac0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xef0]
call fcn.00418e14
mov byte [ebp - 4], 1
xor esi, esi
jmp 0x44b70c
lea ecx, [ebp - 0xf08]
call fcn.00428ee8
mov byte [ebp - 4], 0x8c
lea ecx, [ebp - 0x880]
call fcn.00401ac0
push dword [0x4f273c]
lea eax, [ebp - 0xeb4]
push str.Setup_returning__d
push eax
mov dword [ebp - 0xeb4], str.Setup.cpp
mov dword [ebp - 0xeb0], 0x1b5
call fcn.004191b5
mov esi, dword [0x4f273c]
add esp, 0xc
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0xf08]
call fcn.00428605
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0xf24]
call fcn.0041ddde
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x8e0]
call fcn.00401b80
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x970]
call fcn.00401ac0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xef0]
call fcn.00418e14
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xaf4]
call fcn.00401b80
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xe9c]
call fcn.0044831e
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
call fcn.00473cd0
ret 0x10