Function at 0x403f50
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x593fe7
mov eax, dword fs:[0]
push eax
sub esp, 0xf5c
mov eax, dword [0x616738]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xe8c], ecx
call fcn.0040fcb0
mov ecx, dword [ebp - 0xe8c]
call fcn.00403ec0
mov dword [0x61c728], 0
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0xde4], esp
push 0x5a1af6
call fcn.00408ff0
mov dword [ebp - 0xe90], eax
mov eax, dword [ebp - 0xe90]
mov dword [ebp - 0xe94], eax
mov dword [ebp - 4], 0
push ecx
mov ecx, esp
mov dword [ebp - 0xde8], esp
push 0x5a1b14
call fcn.00408ff0
mov dword [ebp - 0xe98], eax
mov ecx, dword [ebp - 0xe98]
mov dword [ebp - 0xe9c], ecx
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0xdec], esp
push 0x5a1b1c
call fcn.00408ff0
mov dword [ebp - 0xea0], eax
push reloc.OLEAUT32.dll_SysReAllocString
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 4], 0xffffffff
call fcn.00492c20
add esp, 0x18
mov dword [ebp - 0xea4], eax
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.004920f0
test eax, eax
je 0x4040f6
push 1
push 0x1a
lea ecx, [ebp - 0x10]
call fcn.004090f0
push eax
call fcn.0049b2b0
add esp, 0xc
test eax, eax
jne 0x4040f6
call fcn.0049aaf0
test eax, eax
je 0x40407e
push 1
push 0x1a
lea ecx, [ebp - 0x10]
call fcn.004090f0
push eax
call fcn.0049af40
add esp, 0xc
jmp 0x4040f6
push 0x104
lea eax, [ebp - 0x124]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp - 0xe8c]
mov byte [ecx + 0xd0], 1
lea edx, [ebp - 0x124]
push edx
mov ecx, dword [ebp - 0xe8c]
add ecx, 0xd4
call fcn.00409090
mov eax, dword [ebp - 0xe8c]
mov ecx, dword [eax + 0x48]
push ecx
mov ecx, dword [ebp - 0xe8c]
add ecx, 0xd8
call fcn.00409090
mov dword [ebp - 0xdf0], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00408330
mov eax, dword [ebp - 0xdf0]
jmp 0x404f77
mov ecx, dword [ebp - 0xe8c]
call fcn.00404fd0
test eax, eax
jne 0x404129
mov dword [ebp - 0xdf4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00408330
mov eax, dword [ebp - 0xdf4]
jmp 0x404f77
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0xdf8], esp
push 0x5a1b38
call fcn.00408ff0
mov dword [ebp - 0xea8], eax
mov edx, dword [0x61c80c]
push edx
mov ecx, dword [ebp - 0xe8c]
call fcn.00407a60
mov ecx, dword [ebp - 0xe8c]
call fcn.00405490
test eax, eax
jne 0x404189
mov dword [ebp - 0xdfc], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00408330
mov eax, dword [ebp - 0xdfc]
jmp 0x404f77
mov ecx, dword [ebp - 0xe8c]
call fcn.00407120
test eax, eax
jne 0x4041bc
mov dword [ebp - 0xe00], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00408330
mov eax, dword [ebp - 0xe00]
jmp 0x404f77
mov ecx, dword [ebp - 0xe8c]
call fcn.00406840
mov ecx, dword [ebp - 0xe8c]
call fcn.00406ce0
test eax, eax
jne 0x404203
cmp dword [0x61c80c], 0
jne 0x404203
mov dword [ebp - 0xe04], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00408330
mov eax, dword [ebp - 0xe04]
jmp 0x404f77
mov ecx, dword [ebp - 0xe8c]
call fcn.00407e30
test eax, eax
jne 0x404276
mov eax, dword [0x61c80c]
mov dword [ebp - 0xeac], eax
cmp dword [ebp - 0xeac], 0xffffffff
je 0x40423a
cmp dword [ebp - 0xeac], 1
je 0x40423a
cmp dword [ebp - 0xeac], 2
je 0x404252
jmp 0x404276
push 5
push 0
push 0
push str.http:__advert.estsoft.com__event201910015502112
push 0x5a1b78
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0xe08], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00408330
mov eax, dword [ebp - 0xe08]
jmp 0x404f77
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov ecx, dword [0x61c80c]
mov dword [ebp - 0xeb0], ecx
mov edx, dword [ebp - 0xeb0]
add edx, 1
mov dword [ebp - 0xeb0], edx
cmp dword [ebp - 0xeb0], 0xb
ja case.0x4042b2.6
mov eax, dword [ebp - 0xeb0]
jmp dword [eax*4 + 0x404f94]
mov ecx, dword [ebp - 0xe8c]
call fcn.00407550
jmp case.0x4042b2.6
mov ecx, dword [ebp - 0xe8c]
add ecx, 0xd8
push ecx
mov edx, dword [ebp - 0xe8c]
add edx, 0xd4
push edx
mov eax, dword [ebp - 0xe8c]
add eax, 0xd0
push eax
call fcn.00410910
add esp, 0xc
push 0x5a1b80
mov ecx, 0x61c820
call fcn.00407fe0
test eax, eax
je 0x40433c
push 0x5a1b88
lea ecx, [ebp - 0xe0c]
call fcn.00408ff0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe0c]
push ecx
call fcn.004b88a0
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xe0c]
call fcn.00408330
push ecx
mov ecx, esp
mov dword [ebp - 0xe10], esp
push 0x61c820
call fcn.00408fd0
mov dword [ebp - 0xeb4], eax
call fcn.0048fcb0
add esp, 4
mov dword [ebp - 0xeb8], eax
cmp dword [ebp - 0xeb8], 0
je 0x40445e
push ecx
mov esi, esp
mov dword [ebp - 0xe14], esp
push ecx
mov ecx, esp
mov dword [ebp - 0xe18], esp
push 0x61c820
call fcn.00408fd0
mov dword [ebp - 0xebc], eax
push esi
call fcn.0048fd80
add esp, 8
mov dword [ebp - 0xec0], eax
mov edx, dword [ebp - 0xec0]
mov dword [ebp - 0xec4], edx
mov byte [ebp - 4], 4
push ecx
mov esi, esp
mov dword [ebp - 0xe1c], esp
push ecx
mov ecx, esp
mov dword [ebp - 0xe20], esp
push 0x61c820
call fcn.00408fd0
mov dword [ebp - 0xec8], eax
push esi
call fcn.0048d550
add esp, 8
mov dword [ebp - 0xecc], eax
mov eax, dword [ebp - 0xecc]
mov dword [ebp - 0xed0], eax
mov byte [ebp - 4], 2
call fcn.00497e90
add esp, 8
mov dword [ebp - 0xed4], eax
mov ecx, dword [ebp - 0xed4]
mov dword [ebp - 0x128], ecx
cmp dword [ebp - 0x128], 0
jle 0x404438
push 0
push 1
push str._afterupdated
mov ecx, 0x61c820
call fcn.004090f0
push eax
call fcn.0048f310
add esp, 0x10
mov dword [ebp - 0x18], 0
push ecx
mov ecx, esp
mov dword [ebp - 0xe24], esp
push 0x61c820
call fcn.00408fd0
mov dword [ebp - 0xed8], eax
call fcn.0048fe70
add esp, 4
jmp 0x404520
mov dword [ebp - 0x12c], 0
lea ecx, [ebp - 0x130]
call fcn.004a2910
mov byte [ebp - 4], 5
push 1
push 1
push 0
mov ecx, dword [ebp - 0xe8c]
add ecx, 0xac
call fcn.00428ec0
test eax, eax
je 0x404511
lea edx, [ebp - 0x130]
push edx
lea eax, [ebp - 0x12c]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0xe28], esp
push 0x61c820
call fcn.00408fd0
mov dword [ebp - 0xedc], eax
mov ecx, dword [ebp - 0xe8c]
add ecx, 0xac
call fcn.0042a830
mov dword [ebp - 0xee0], eax
cmp dword [ebp - 0xee0], 0
je 0x404511
cmp dword [ebp - 0x12c], 1
jne 0x404511
push 0x5a1ba4
mov ecx, 0x61c820
call fcn.00407fe0
test eax, eax
je 0x404511
push 0
push 1
push 0x5a1bb0
mov ecx, 0x61c820
call fcn.004090f0
push eax
call fcn.0048f310
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x130]
call fcn.00408330
jmp case.0x4042b2.6
lea ecx, [ebp - 0x14]
push ecx
push 0x61c820
call fcn.0048e810
add esp, 8
test eax, eax
je 0x40487e
mov ecx, 0x61c820
call fcn.004090f0
push eax
mov ecx, dword [ebp - 0xe8c]
call fcn.00407820
test eax, eax
jne 0x4045ae
push 7
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0xe2c], esp
push 0x61c820
call fcn.00408fd0
mov dword [ebp - 0xee4], eax
call fcn.0048e5e0
add esp, 0xc
push 0x61c820
call fcn.0049b580
add esp, 4
mov dword [ebp - 0xe30], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00408330
mov eax, dword [ebp - 0xe30]
jmp 0x404f77
mov ecx, 0x61c820
call fcn.004090f0
push eax
call fcn.0048f8f0
add esp, 4
cmp eax, 1
jne 0x4047e1
mov dword [ebp - 0x134], 0
lea ecx, [ebp - 0x138]
call fcn.004a2910
mov byte [ebp - 4], 6
push 1
push 1
push 0
mov ecx, dword [ebp - 0xe8c]
add ecx, 0xac
call fcn.00428ec0
test eax, eax
je 0x4047c6
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp - 0x134]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0xe34], esp
push 0x61c820
call fcn.00408fd0
mov dword [ebp - 0xee8], eax
mov ecx, dword [ebp - 0xe8c]
add ecx, 0xac
call fcn.0042a830
mov dword [ebp - 0xeec], eax
cmp dword [ebp - 0xeec], 0
je 0x4047c6
cmp dword [ebp - 0x134], 0
jne 0x404677
push 0
push 0
push str._updatenotice
mov ecx, 0x61c820
call fcn.004090f0
push eax
call fcn.0048f310
add esp, 0x10
jmp 0x4047c6
call fcn.0049aba0
test eax, eax
je 0x4047c6
push ecx
mov ecx, esp
mov dword [ebp - 0xe38], esp
push 0x5a1bcc
call fcn.00408ff0
mov dword [ebp - 0xef0], eax
call fcn.004af4c0
add esp, 4
mov dword [ebp - 0xef4], eax
cmp dword [ebp - 0xef4], 1
jne 0x4047c6
push 0x5a1bdc
push ecx
mov ecx, esp
mov dword [ebp - 0xe40], esp
push 0x61c820
call fcn.00408fd0
mov dword [ebp - 0xef8], eax
lea ecx, [ebp - 0xe44]
push ecx
call fcn.004915b0
add esp, 8
mov dword [ebp - 0xefc], eax
mov edx, dword [ebp - 0xefc]
mov dword [ebp - 0xf00], edx
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0xf00]
call fcn.00407fe0
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0xe39], al
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xe44]
call fcn.00408330
movzx eax, byte [ebp - 0xe39]
test eax, eax
je 0x404749
push 0
push 1
push 0x5a1be0
mov ecx, 0x61c820
call fcn.004090f0
push eax
call fcn.0048f310
add esp, 0x10
push 0x5a1bec
mov ecx, 0x61c820
call fcn.00407fe0
test eax, eax
jne 0x404778
push 0
push 1
push 0x5a1bf8
mov ecx, 0x61c820
call fcn.004090f0
push eax
call fcn.0048f310
add esp, 0x10
push str.silent
lea ecx, [ebp - 0x138]
call fcn.00407fe0
test eax, eax
jne 0x4047aa
push 1
push 0
push 0x5a1c0c
mov ecx, 0x61c820
call fcn.004090f0
push eax
call fcn.0048f310
add esp, 0x10
jmp 0x4047c6
push 1
push 0
push 0x5a1c1c
mov ecx, 0x61c820
call fcn.004090f0
push eax
call fcn.0048f310
add esp, 0x10
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x138]
call fcn.00408330
jmp 0x40487c
push 0x61c820
call fcn.0049b580
add esp, 4
push 0
mov ecx, dword [ebp - 0xe8c]
mov edx, dword [ecx + 0xc8]
push edx
push ecx
mov ecx, esp
mov dword [ebp - 0xe48], esp
push 0x61c820
call fcn.00408fd0
mov dword [ebp - 0xf04], eax
lea ecx, [ebp - 0xdb4]
call fcn.00416c40
mov dword [ebp - 0xf08], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xdb4]
call fcn.00553d36
sub eax, 1
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x18], eax
push 7
mov eax, dword [ebp - 0x184]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0xe4c], esp
push 0x61c820
call fcn.00408fd0
mov dword [ebp - 0xf0c], eax
call fcn.0048e5e0
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xdb4]
call fcn.00416df0
jmp 0x4048b6
cmp dword [0x620828], 4
jne 0x4048a9
push str._foraltoolbar
mov ecx, dword [0x62082c]
mov edx, dword [ecx + 0xc]
push edx
call fcn.0056efc8
add esp, 8
test eax, eax
jne 0x4048a9
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x14], 0
je 0x4048b6
mov dword [ebp - 0x18], 0
jmp case.0x4042b2.6
mov ecx, 0x61c820
call fcn.004090f0
push eax
call fcn.0048f8f0
add esp, 4
cmp eax, 1
jne 0x4048f6
push 0
push 0
push str._explicitupdate
mov ecx, 0x61c820
call fcn.004090f0
push eax
call fcn.0048f310
add esp, 0x10
mov dword [ebp - 0x18], 0
jmp case.0x4042b2.6
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xdb8], 0
lea ecx, [ebp - 0xdbc]
call fcn.004a2910
mov byte [ebp - 4], 9
push 1
push 1
push 0
mov ecx, dword [ebp - 0xe8c]
add ecx, 0xac
call fcn.00428ec0
test eax, eax
je 0x4049a2
lea eax, [ebp - 0xdbc]
push eax
lea ecx, [ebp - 0xdb8]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0xe50], esp
push 0x61c820
call fcn.00408fd0
mov dword [ebp - 0xf10], eax
mov ecx, dword [ebp - 0xe8c]
add ecx, 0xac
call fcn.0042a830
mov dword [ebp - 0xf14], eax
cmp dword [ebp - 0xf14], 0
je 0x4049a2
cmp dword [ebp - 0xdb8], 1
jne 0x4049a2
push 0
push 1
push 0x5a1c48
mov ecx, 0x61c820
call fcn.004090f0
push eax
call fcn.0048f310
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xdbc]
call fcn.00408330
jmp case.0x4042b2.6
mov dword [ebp - 0x18], 0
call fcn.0049aba0
test eax, eax
je 0x404aa8
push ecx
mov ecx, esp
mov dword [ebp - 0xe54], esp
push 0x5a1c54
call fcn.00408ff0
mov dword [ebp - 0xf18], eax
call fcn.004af4c0
add esp, 4
mov dword [ebp - 0xf1c], eax
cmp dword [ebp - 0xf1c], 1
jne 0x404aa8
push 1
push 0x61c820
call fcn.00490300
add esp, 8
push str.SILENT
push 0x61c820
lea edx, [ebp - 0xe5c]
push edx
call fcn.00490410
add esp, 8
mov dword [ebp - 0xf20], eax
mov eax, dword [ebp - 0xf20]
mov dword [ebp - 0xf24], eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0xf24]
call fcn.00407fe0
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0xe55], al
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xe5c]
call fcn.00408330
movzx ecx, byte [ebp - 0xe55]
test ecx, ecx
je 0x404a8c
push 1
push 0
push str._silentupdate
mov ecx, 0x61c820
call fcn.004090f0
push eax
call fcn.0048f310
add esp, 0x10
jmp 0x404aa8
push 1
push 0
push str._bgupdate
mov ecx, 0x61c820
call fcn.004090f0
push eax
call fcn.0048f310
add esp, 0x10
jmp case.0x4042b2.6
call fcn.0049aaf0
test eax, eax
je 0x404c3d
mov dword [ebp - 0xdc0], 0
push 0x5a1af7
lea ecx, [ebp - 0xdc4]
call fcn.00408ff0
mov byte [ebp - 4], 0xb
mov edx, dword [0x61c820]
push edx
push str._afterreboot__s
lea eax, [ebp - 0xdc4]
push eax
call fcn.004098b0
add esp, 0xc
mov ecx, dword [ebp - 0xe8c]
call fcn.004055c0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 0xdc4]
call fcn.004090f0
push eax
lea ecx, [ebp - 0xe60]
push ecx
call fcn.0049a3b0
add esp, 4
mov dword [ebp - 0xf28], eax
mov edx, dword [ebp - 0xf28]
mov dword [ebp - 0xf2c], edx
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0xf2c]
call fcn.004090f0
push eax
call fcn.0049a8c0
add esp, 0x18
mov dword [ebp - 0xdc0], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xe60]
call fcn.00408330
cmp dword [ebp - 0xdc0], 0x20
jle 0x404b75
mov dword [ebp - 0x18], 0
jmp 0x404c2e
push 0x5a1b13
lea ecx, [ebp - 0xdc8]
call fcn.00408ff0
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0xdc0]
mov dword [ebp - 0xf30], eax
cmp dword [ebp - 0xf30], 5
je 0x404ba0
jmp 0x404c1f
push 0x61c820
lea ecx, [ebp - 0xe64]
push ecx
call fcn.0049b400
add esp, 8
mov dword [ebp - 0xf34], eax
mov edx, dword [ebp - 0xf34]
mov dword [ebp - 0xf38], edx
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0xf38]
mov ecx, dword [eax]
push ecx
push 0x275d
lea edx, [ebp - 0xdc8]
push edx
call fcn.00408e80
add esp, 0xc
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xe64]
call fcn.00408330
push 0
push 0x10
lea ecx, [ebp - 0xdc8]
call fcn.004090f0
push eax
call fcn.00552696
push 0x61c820
call fcn.0049b660
add esp, 4
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xdc8]
call fcn.00408330
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xdc4]
call fcn.00408330
jmp case.0x4042b2.6
lea ecx, [ebp - 0xdc9]
call fcn.004300e0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xdc9]
call fcn.00430100
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xdc9]
call fcn.004300f0
mov dword [ebp - 0xe68], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00408330
mov eax, dword [ebp - 0xe68]
jmp 0x404f77
mov dword [ebp - 0x18], 0
cmp dword [0x620828], 3
jl case.0x4042b2.6
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0xe6c], esp
push 0x5a1b36
call fcn.00408ff0
mov dword [ebp - 0xf3c], eax
mov eax, dword [ebp - 0xf3c]
mov dword [ebp - 0xf40], eax
mov byte [ebp - 4], 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0xe70], esp
push 0x5a1c98
call fcn.00408ff0
mov dword [ebp - 0xf44], eax
mov ecx, dword [ebp - 0xf44]
mov dword [ebp - 0xf48], ecx
mov byte [ebp - 4], 0x11
push ecx
mov ecx, esp
mov dword [ebp - 0xe74], esp
push 0x5a1ca0
call fcn.00408ff0
mov dword [ebp - 0xf4c], eax
push reloc.OLEAUT32.dll_SysReAllocString
lea edx, [ebp - 0xdd0]
push edx
mov byte [ebp - 4], 2
call fcn.00492c20
add esp, 0x18
mov dword [ebp - 0xf50], eax
mov byte [ebp - 4], 0x12
push ecx
mov ecx, esp
mov dword [ebp - 0xe78], esp
push 0x5a1cbc
call fcn.00408ff0
mov dword [ebp - 0xf54], eax
mov eax, dword [ebp - 0xf54]
mov dword [ebp - 0xf58], eax
mov byte [ebp - 4], 0x13
push ecx
mov ecx, esp
mov dword [ebp - 0xe7c], esp
lea edx, [ebp - 0xdd0]
push edx
call fcn.00408fd0
mov dword [ebp - 0xf5c], eax
lea eax, [ebp - 0xdd8]
push eax
mov byte [ebp - 4], 0x12
call fcn.00499b70
add esp, 0xc
mov dword [ebp - 0xf60], eax
mov byte [ebp - 4], 0x14
mov byte [ebp - 0xdca], 1
cmp dword [0x620828], 3
jle 0x404deb
mov ecx, dword [0x62082c]
mov edx, dword [ecx + 0xc]
push edx
lea ecx, [ebp - 0xddc]
call fcn.00408ff0
mov byte [ebp - 4], 0x15
push str.nocrlcheck
lea ecx, [ebp - 0xddc]
call fcn.00407fe0
test eax, eax
jne 0x404ddc
mov byte [ebp - 0xdca], 0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xddc]
call fcn.00408330
movzx eax, byte [ebp - 0xdca]
push eax
push 0
lea ecx, [ebp - 0xdd8]
call fcn.004090f0
push eax
call fcn.004a0960
add esp, 0xc
mov dword [ebp - 0xdd4], eax
cmp dword [ebp - 0xdd4], 1
jne 0x404f3b
mov ecx, dword [0x62082c]
mov edx, dword [ecx + 8]
push edx
lea ecx, [ebp - 0xde0]
call fcn.00408ff0
mov byte [ebp - 4], 0x16
push str.install
lea ecx, [ebp - 0xde0]
call fcn.00407fe0
test eax, eax
jne 0x404e7c
movzx eax, byte [ebp - 0xdca]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0xe80], esp
push str._install
call fcn.00408ff0
mov dword [ebp - 0xf64], eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xe8c]
call fcn.00407a60
jmp 0x404f2c
push 0x5a1ce8
lea ecx, [ebp - 0xde0]
call fcn.00407fe0
test eax, eax
jne 0x404ec0
movzx ecx, byte [ebp - 0xdca]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0xe84], esp
push str._start
call fcn.00408ff0
mov dword [ebp - 0xf68], eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xe8c]
call fcn.00407a60
jmp 0x404f2c
push str.uninstall
lea ecx, [ebp - 0xde0]
call fcn.00407fe0
test eax, eax
jne 0x404ef7
push 0
push 1
push 1
push 0
push str._uninstall
lea ecx, [ebp - 0xdd8]
call fcn.004090f0
push eax
call fcn.0049a8c0
add esp, 0x18
jmp 0x404f2c
push str.stop
lea ecx, [ebp - 0xde0]
call fcn.00407fe0
test eax, eax
jne 0x404f2c
push 0
push 1
push 1
push 0
push str._stop
lea ecx, [ebp - 0xdd8]
call fcn.004090f0
push eax
call fcn.0049a8c0
add esp, 0x18
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xde0]
call fcn.00408330
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xdd8]
call fcn.00408330
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xdd0]
call fcn.00408330
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0xe88], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00408330
mov eax, dword [ebp - 0xe88]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0056edd3
mov esp, ebp
pop ebp
ret