Function at 0x45e400
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ea981
mov eax, dword fs:[0]
push eax
sub esp, 0x358
mov eax, dword [0x677000]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov ebx, dword [0x74e2f0]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0x40
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x2d8]
push 0
push eax
mov dword [ebp - 0x2f0], ebx
mov dword [ebp - 0x2dc], 0
call fcn.005bb1c0
add esp, 0xc
xorps xmm0, xmm0
push str.____________________________________________________
mov dword [ebp - 0x2ec], 0
movq qword [ebp - 0x2e8], xmm0
mov dword [ebp - 0x2e0], 0
call fcn.00418730
cmp dword [edi + 0x14], 8
jb 0x45e499
mov eax, dword [edi]
jmp 0x45e49b
mov eax, edi
push eax
push str.CFuncMgr::DoAppInstall___s__App_Install_Start
push 0xffffffffffffffff
push 0x1000
push 0x74e818
call fcn.005b8769
add esp, 0x14
push 0x74e818
call fcn.00418730
push 8
xor eax, eax
push 0x63b97c
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x250], 7
mov dword [ebp - 0x254], 0
mov word [ebp - 0x264], ax
call fcn.00406400
push 0xffffffffffffffff
push 0
push edi
lea ecx, [ebp - 0x264]
mov dword [ebp - 4], 0
call fcn.004061c0
cmp dword [edi + 0x14], 8
jb 0x45e50f
mov edx, dword [edi]
jmp 0x45e511
mov edx, edi
xor eax, eax
mov dword [ebp - 0x30c], 7
mov dword [ebp - 0x310], 0
mov word [ebp - 0x320], ax
cmp word [edx], ax
jne 0x45e537
xor ecx, ecx
jmp 0x45e555
mov ecx, edx
lea ebx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45e540
sub ecx, ebx
mov ebx, dword [ebp - 0x2f0]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x320]
call fcn.00406400
mov byte [ebp - 4], 1
push 0xb
xor eax, eax
push str.InstAppName
lea ecx, [ebp - 0x308]
mov dword [ebp - 0x2f4], 7
mov dword [ebp - 0x2f8], 0
mov word [ebp - 0x308], ax
call fcn.00406400
lea eax, [ebp - 0x320]
mov byte [ebp - 4], 2
mov ecx, dword [0x74e2f4]
push eax
lea eax, [ebp - 0x308]
push eax
lea ecx, [ecx + 0xc]
call fcn.00409f70
cmp dword [ebp - 0x2f4], 8
jb 0x45e5cc
push dword [ebp - 0x308]
call fcn.0049500b
add esp, 4
xor eax, eax
mov byte [ebp - 4], al
cmp dword [ebp - 0x30c], 8
mov dword [ebp - 0x2f4], 7
mov dword [ebp - 0x2f8], 0
mov word [ebp - 0x308], ax
jb 0x45e603
push dword [ebp - 0x320]
call fcn.0049500b
add esp, 4
push 4
xor eax, eax
push str.FILE
lea ecx, [ebp - 0x308]
mov dword [ebp - 0x2f4], 7
mov dword [ebp - 0x2f8], 0
mov word [ebp - 0x308], ax
call fcn.00406400
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x264]
push eax
mov byte [ebp - 4], 3
mov ecx, dword [0x74e2f4]
push esi
lea eax, [ebp - 0x340]
push eax
lea ecx, [ecx + 0x2c]
call fcn.00414810
push eax
lea eax, [ebp - 0x24c]
push eax
mov ecx, ebx
mov byte [ebp - 4], 4
call fcn.00460be0
cmp dword [ebp - 0x32c], 8
jb 0x45e684
push dword [ebp - 0x340]
call fcn.0049500b
add esp, 4
xor eax, eax
mov dword [ebp - 0x32c], 7
mov dword [ebp - 0x330], 0
mov word [ebp - 0x340], ax
mov byte [ebp - 4], 7
cmp dword [ebp - 0x2f4], 8
jb 0x45e6bc
push dword [ebp - 0x308]
call fcn.0049500b
add esp, 4
xor eax, eax
push 6
push str.OPTION
lea ecx, [ebp - 0x320]
mov dword [ebp - 0x2f4], 7
mov dword [ebp - 0x2f8], 0
mov word [ebp - 0x308], ax
mov dword [ebp - 0x30c], 7
mov dword [ebp - 0x310], eax
mov word [ebp - 0x320], ax
call fcn.00406400
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x264]
push eax
mov byte [ebp - 4], 8
mov ecx, dword [0x74e2f4]
push esi
lea eax, [ebp - 0x360]
push eax
lea ecx, [ecx + 0x2c]
call fcn.00414810
push eax
lea eax, [ebp - 0x234]
push eax
mov ecx, ebx
mov byte [ebp - 4], 9
call fcn.00460be0
cmp dword [ebp - 0x34c], 8
jb 0x45e754
push dword [ebp - 0x360]
call fcn.0049500b
add esp, 4
xor eax, eax
mov dword [ebp - 0x34c], 7
mov dword [ebp - 0x350], 0
mov word [ebp - 0x360], ax
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x30c], 8
jb 0x45e78c
push dword [ebp - 0x320]
call fcn.0049500b
add esp, 4
xor eax, eax
push 9
push str.OPTION_FW
lea ecx, [ebp - 0x308]
mov dword [ebp - 0x30c], 7
mov dword [ebp - 0x310], 0
mov word [ebp - 0x320], ax
mov dword [ebp - 0x2f4], 7
mov dword [ebp - 0x2f8], eax
mov word [ebp - 0x308], ax
call fcn.00406400
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x264]
push eax
mov byte [ebp - 4], 0xd
mov ecx, dword [0x74e2f4]
push esi
lea eax, [ebp - 0x340]
push eax
lea ecx, [ecx + 0x2c]
call fcn.00414810
push eax
lea eax, [ebp - 0x27c]
push eax
mov ecx, ebx
mov byte [ebp - 4], 0xe
call fcn.00460be0
cmp dword [ebp - 0x32c], 8
jb 0x45e824
push dword [ebp - 0x340]
call fcn.0049500b
add esp, 4
xor eax, eax
mov dword [ebp - 0x32c], 7
mov dword [ebp - 0x330], 0
mov word [ebp - 0x340], ax
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x2f4], 8
jb 0x45e85c
push dword [ebp - 0x308]
call fcn.0049500b
add esp, 4
xor eax, eax
push 9
push str.PARAMETER
lea ecx, [ebp - 0x320]
mov dword [ebp - 0x2f4], 7
mov dword [ebp - 0x2f8], 0
mov word [ebp - 0x308], ax
mov dword [ebp - 0x30c], 7
mov dword [ebp - 0x310], eax
mov word [ebp - 0x320], ax
call fcn.00406400
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x264]
push eax
mov byte [ebp - 4], 0x12
mov ecx, dword [0x74e2f4]
push esi
lea eax, [ebp - 0x294]
push eax
lea ecx, [ecx + 0x2c]
call fcn.00414810
mov byte [ebp - 4], 0x14
cmp dword [ebp - 0x30c], 8
jb 0x45e8e5
push dword [ebp - 0x320]
call fcn.0049500b
add esp, 4
xor eax, eax
push 0x10
push str.IsNeedCurrentDir
lea ecx, [ebp - 0x308]
mov dword [ebp - 0x30c], 7
mov dword [ebp - 0x310], 0
mov word [ebp - 0x320], ax
mov dword [ebp - 0x2f4], 7
mov dword [ebp - 0x2f8], eax
mov word [ebp - 0x308], ax
call fcn.00406400
lea eax, [ebp - 0x308]
push eax
mov byte [ebp - 4], 0x15
mov ecx, dword [0x74e2f4]
lea eax, [ebp - 0x264]
push eax
push esi
lea ecx, [ecx + 0x2c]
call fcn.00414aa0
mov byte [ebp - 4], 0x14
cmp dword [ebp - 0x2f4], 8
mov dword [ebp - 0x348], eax
jb 0x45e96d
push dword [ebp - 0x308]
call fcn.0049500b
add esp, 4
push 8
xor eax, eax
push str.Interval
lea ecx, [ebp - 0x308]
mov dword [ebp - 0x2f4], 7
mov dword [ebp - 0x2f8], 0
mov word [ebp - 0x308], ax
call fcn.00406400
lea eax, [ebp - 0x308]
push eax
mov byte [ebp - 4], 0x16
mov ecx, dword [0x74e2f4]
lea eax, [ebp - 0x264]
push eax
push esi
lea ecx, [ecx + 0x2c]
call fcn.00414aa0
mov byte [ebp - 4], 0x14
cmp dword [ebp - 0x2f4], 8
mov ebx, eax
jb 0x45e9da
push dword [ebp - 0x308]
call fcn.0049500b
add esp, 4
push 7
xor eax, eax
push str.Timeout
lea ecx, [ebp - 0x308]
mov dword [ebp - 0x2f4], 7
mov dword [ebp - 0x2f8], 0
mov word [ebp - 0x308], ax
call fcn.00406400
lea eax, [ebp - 0x308]
push eax
mov byte [ebp - 4], 0x17
mov ecx, dword [0x74e2f4]
lea eax, [ebp - 0x264]
push eax
push esi
lea ecx, [ecx + 0x2c]
call fcn.00414aa0
mov byte [ebp - 4], 0x14
cmp dword [ebp - 0x2f4], 8
mov dword [ebp - 0x324], eax
jb 0x45ea51
push dword [ebp - 0x308]
call fcn.0049500b
mov eax, dword [ebp - 0x324]
add esp, 4
mov ecx, 0x64
test ebx, ebx
cmove ebx, ecx
test eax, eax
mov ecx, 0x493e0
cmove eax, ecx
mov dword [ebp - 0x324], eax
push 0xe
xor eax, eax
push str.FIREWALL_BLOCK
lea ecx, [ebp - 0x308]
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x2f4], 7
mov dword [ebp - 0x2f8], 0
mov word [ebp - 0x308], ax
call fcn.00406400
mov byte [ebp - 4], 0x18
mov ecx, dword [0x74e2f4]
lea eax, [ebp - 0x308]
push eax
add ecx, 0xc
call fcn.00409da0
cmp eax, 1
sete bl
mov byte [ebp - 4], 0x14
cmp dword [ebp - 0x2f4], 8
jb 0x45eada
push dword [ebp - 0x308]
call fcn.0049500b
add esp, 4
test bl, bl
je 0x45eb33
push 0
push 0x624ff8
push dword [ebp - 0x26c]
push ecx
lea ecx, [ebp - 0x27c]
call fcn.00407060
test eax, eax
je 0x45eb33
cmp dword [ebp - 0x220], 8
lea eax, [ebp - 0x234]
cmovae eax, dword [ebp - 0x234]
xor ecx, ecx
push 0xffffffffffffffff
mov dword [ebp - 0x224], 0
mov word [eax], cx
push ecx
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x234]
call fcn.00405f70
push 0
push 0x624ff8
push dword [ebp - 0x284]
push ecx
lea ecx, [ebp - 0x294]
call fcn.00407060
test eax, eax
je 0x45eb63
mov ecx, dword [ebp - 0x2f0]
lea eax, [ebp - 0x294]
push eax
push esi
call fcn.00461e40
call fcn.0049f407
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x45eb7f
push 0x80004005
call fcn.00407a60
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2f0], eax
push 0
push 0x624ff8
mov byte [ebp - 4], 0x19
push dword [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x234]
call fcn.00407060
test eax, eax
lea eax, [ebp - 0x24c]
je 0x45ebf0
cmp dword [ebp - 0x220], 8
lea ecx, [ebp - 0x234]
cmovae ecx, dword [ebp - 0x234]
cmp dword [ebp - 0x238], 8
push ecx
cmovae eax, dword [ebp - 0x24c]
push eax
lea eax, [ebp - 0x2f0]
push str.__s___s
push eax
call fcn.00407b30
add esp, 0x10
jmp 0x45ec13
cmp dword [ebp - 0x238], 8
cmovae eax, dword [ebp - 0x24c]
push eax
lea eax, [ebp - 0x2f0]
push 0x63bae0
push eax
call fcn.00407b30
add esp, 0xc
mov esi, dword [ebp - 0x2f0]
cmp dword [esi - 4], 1
jle 0x45ec33
push dword [esi - 0xc]
lea ecx, [ebp - 0x2f0]
call fcn.004078e0
mov esi, dword [ebp - 0x2f0]
cmp dword [edi + 0x14], 8
jb 0x45ec3d
mov eax, dword [edi]
jmp 0x45ec3f
mov eax, edi
push esi
push eax
push str.CFuncMgr::DoAppInstall___s__App_Install_Command:_s
push 0xffffffffffffffff
push 0x1000
push 0x74e818
call fcn.005b8769
add esp, 0x18
push 0x74e818
call fcn.00418730
mov eax, 5
mov word [ebp - 0x2ac], ax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
mov dword [ebp - 0x2dc], 0x44
mov dword [ebp - 0x2b0], 1
call fcn.005bb1c0
add esp, 0xc
xor ebx, ebx
cmp dword [ebp - 0x348], 1
jne 0x45ed20
cmp dword [ebp - 0x238], 8
lea eax, [ebp - 0x24c]
cmovae eax, dword [ebp - 0x24c]
push eax
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.005ba6d5
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
cmp dword [edi + 0x14], 8
lea ebx, [ebp - 0x21c]
jb 0x45ecf3
mov eax, dword [edi]
jmp 0x45ecf5
mov eax, edi
lea ecx, [ebp - 0x21c]
push ecx
push eax
push str.CFuncMgr::DoAppInstall___s__CurrentDirectory:_s
push 0xffffffffffffffff
push 0x1000
push 0x74e818
call fcn.005b8769
add esp, 0x18
push 0x74e818
call fcn.00418730
cmp dword [esi - 4], 1
jle 0x45ed3a
push dword [esi - 0xc]
lea ecx, [ebp - 0x2f0]
call fcn.004078e0
mov esi, dword [ebp - 0x2f0]
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x2dc]
push eax
push ebx
push 0
push 0x20
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x45eea9
mov eax, dword [ebp - 0x2ec]
test eax, eax
je 0x45eea9
mov ecx, dword [ebp - 0x2e8]
test ecx, ecx
je 0x45ed89
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2ec]
push dword [ebp - 0x328]
xor ebx, ebx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x45edc1
lea esp, [esp]
mov eax, dword [ebp - 0x328]
add ebx, eax
cmp ebx, dword [ebp - 0x324]
ja 0x45edeb
push eax
push dword [ebp - 0x2ec]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x45eda0
call fcn.00466550
mov ebx, dword [ebp - 0x344]
test ebx, ebx
je 0x45ee5a
push ebx
push dword [ebp - 0x2ec]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [edi + 0x14], 8
jb 0x45ee32
mov eax, dword [edi]
jmp 0x45ee34
push 0
push dword [ebp - 0x2ec]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x2ec]
test eax, eax
je 0x45ee0b
push eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
cmp dword [edi + 0x14], 8
jb 0x45ee13
mov edi, dword [edi]
push edi
push str.CFuncMgr::DoAppInstall___s__App_CreateProcess___Timeout_Failed
push 0xffffffffffffffff
push 0x1000
push 0x74e818
call fcn.005b8769
add esp, 0x14
jmp 0x45eed2
mov eax, edi
push dword [ebx]
push eax
push str.CFuncMgr::DoAppInstall___s__App_CreateProcess___ExitCode:0x_08x
push 0xffffffffffffffff
push 0x1000
push 0x74e818
call fcn.005b8769
add esp, 0x18
push 0x74e818
call fcn.00418730
mov eax, dword [ebp - 0x2ec]
test eax, eax
je 0x45ee6c
push eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
cmp dword [edi + 0x14], 8
jb 0x45ee74
mov edi, dword [edi]
push edi
push str.CFuncMgr::DoAppInstall___s__App_Install_End
push 0xffffffffffffffff
push 0x1000
push 0x74e818
call fcn.005b8769
add esp, 0x14
push 0x74e818
call fcn.00418730
push str.____________________________________________________
call fcn.00418730
mov edi, 1
jmp 0x45eee8
cmp dword [edi + 0x14], 8
jb 0x45eeb1
mov edi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str.CFuncMgr::DoAppInstall___s__App_CreateProcess___Failed_:0x_08x
push 0xffffffffffffffff
push 0x1000
push 0x74e818
call fcn.005b8769
add esp, 0x18
push 0x74e818
call fcn.00418730
push str.____________________________________________________
call fcn.00418730
xor edi, edi
add esi, 0xfffffff0
mov byte [ebp - 4], 0x14
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45ef06
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x280], 8
jb 0x45ef1d
push dword [ebp - 0x294]
call fcn.0049500b
add esp, 4
xor eax, eax
cmp dword [ebp - 0x268], 8
mov dword [ebp - 0x280], 7
mov dword [ebp - 0x284], 0
mov word [ebp - 0x294], ax
jb 0x45ef51
push dword [ebp - 0x27c]
call fcn.0049500b
add esp, 4
xor eax, eax
cmp dword [ebp - 0x220], 8
mov dword [ebp - 0x268], 7
mov dword [ebp - 0x26c], 0
mov word [ebp - 0x27c], ax
jb 0x45ef85
push dword [ebp - 0x234]
call fcn.0049500b
add esp, 4
xor eax, eax
cmp dword [ebp - 0x238], 8
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
jb 0x45efb9
push dword [ebp - 0x24c]
call fcn.0049500b
add esp, 4
xor eax, eax
cmp dword [ebp - 0x250], 8
mov dword [ebp - 0x238], 7
mov dword [ebp - 0x23c], 0
mov word [ebp - 0x24c], ax
jb 0x45efed
push dword [ebp - 0x264]
call fcn.0049500b
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005b7f8f
mov esp, ebp
pop ebp
ret 0xc