Function at 0x404190
Capabilities:
Check if file exists
Check mutex on windows
Create process on windows
Get common file path
Get program files directory
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4500a7
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x163c
call fcn.0043bfe0
mov eax, dword [0x4655f0]
xor eax, esp
mov dword [esp + 0x1638], eax
push ebx
push esi
push edi
mov eax, dword [0x4655f0]
xor eax, esp
push eax
lea eax, [esp + 0x1650]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x5c], edi
call fcn.0041fb5f
mov eax, dword [eax + 8]
lea ecx, [esp + 0xd4]
push ecx
push str.32770
push eax
call dword [sym.imp.USER32.dll_GetClassInfoA]
lea edx, [esp + 0xd4]
push edx
mov dword [esp + 0xfc], str.filehambrowser_class
call fcn.0041dfe7
lea eax, [esp + 0x60]
push eax
mov dword [esp + 0x64], 8
mov dword [esp + 0x68], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, edi
call fcn.00423d04
push 0
call fcn.00425779
add esp, 4
push str.FileHamBrowser
mov ecx, edi
call fcn.00425cee
push 0x103
lea ecx, [esp + 0x1541]
push 0
push ecx
mov byte [esp + 0x1548], 0
call fcn.0043b390
add esp, 0xc
push 0
push 0x26
lea edx, [esp + 0x1544]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [esp + 0x153c]
push 0x456f6e
push eax
call fcn.004369f3
add esp, 8
test eax, eax
jne 0x4042ad
push str.C:Program_Files
lea ecx, [esp + 0x1540]
push 0x104
push ecx
call fcn.00437c78
add esp, 0xc
lea edx, [esp + 0x153c]
push edx
lea ecx, [esp + 0x3c]
call fcn.004017a0
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x165c], 0
call fcn.00406d30
mov byte [esp + 0x23], 1
mov byte [esp + 0x22], 0
call fcn.00418933
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4042f7
push 0x80004005
call fcn.00401640
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x44], eax
mov byte [esp + 0x1658], 1
call fcn.00418933
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404329
push 0x80004005
call fcn.00401640
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x4c], eax
mov byte [esp + 0x1658], 2
call fcn.00418933
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40435b
push 0x80004005
call fcn.00401640
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x40], eax
push 0x456f6e
push str.PartnerCode
push str.Setting
lea ecx, [esp + 0x5c]
push ecx
mov ecx, edi
mov byte [esp + 0x1668], 3
call fcn.00425f13
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x165c], 4
call fcn.00401ae0
mov byte [esp + 0x1658], 3
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4043c8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x44]
cmp dword [ecx - 0xc], 0
je 0x4043e2
lea edx, [esp + 0x44]
lea ecx, [edi + 0xa8]
push edx
call fcn.00401ae0
mov eax, dword [esp + 0x38]
push 0x4575bc
push str.Fileham.comFileHamBrowser
push eax
lea ecx, [esp + 0x58]
push str._s_s_s
push ecx
call fcn.00401d60
mov edx, dword [esp + 0x4c]
add esp, 0x14
push str.Fileham.comFileHamBrowser
push edx
lea eax, [esp + 0x48]
push str._s_shtmlLoading1.html
push eax
call fcn.00401d60
add esp, 0x10
cmp dword [0x468cb0], 1
jle 0x404cef
call fcn.00418933
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404446
push 0x80004005
call fcn.00401640
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x3c], eax
mov byte [esp + 0x1658], 5
call fcn.00418933
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404478
push 0x80004005
call fcn.00401640
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
push 0x457614
lea ecx, [esp + 0x20]
mov byte [esp + 0x165c], 6
call fcn.004017a0
mov byte [esp + 0x1658], 7
mov ecx, dword [0x468cb4]
mov edx, dword [ecx + 4]
push edx
lea eax, [esp + 0x40]
push 0x457618
push eax
call fcn.00401d60
mov eax, dword [esp + 0x48]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x28], esp
mov esi, esp
push eax
mov dword [esp + 0x58], eax
call fcn.00401c50
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00405a30
mov esi, eax
test esi, esi
jne 0x40451a
lea ecx, [esp + 0x3c]
lea ebx, [edi + 0xa8]
push ecx
mov ecx, ebx
call fcn.00401ae0
mov ebx, dword [ebx]
call fcn.0041fb5f
mov eax, dword [eax + 4]
push ebx
push str.PartnerCode
push str.Setting
mov ecx, eax
call fcn.00425e7d
cmp dword [0x468cb0], 2
jle 0x404570
lea edx, [esp + 0x3c]
lea ecx, [edi + 0xa8]
push edx
call fcn.00401ae0
mov eax, dword [0x468cb4]
mov ecx, dword [eax + 8]
push ecx
lea edx, [esp + 0x34]
push 0x457618
push edx
call fcn.00401d60
mov eax, dword [esp + 0x3c]
add esp, 8
add eax, 0xfffffff0
mov dword [esp + 0x28], esp
mov esi, esp
push eax
call fcn.00401c50
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.00405a30
mov esi, eax
cmp dword [0x468cb0], 3
jle 0x404594
mov eax, dword [0x468cb4]
mov ecx, dword [eax + 0xc]
push ecx
lea edx, [esp + 0x20]
push 0x457618
push edx
call fcn.00401d60
add esp, 0xc
xor bl, bl
lea eax, [esi - 1]
cmp eax, 0xb
mov byte [esp + 0x37], bl
mov byte [esp + 0x1b], bl
ja case.default.0x4045aa
jmp dword [eax*4 + 0x40586c]
mov byte [esp + 0x22], 1
jmp case.default.0x4045aa
mov byte [esp + 0x22], 1
mov bl, 1
call fcn.00406100
call fcn.00405de0
jmp case.default.0x4045aa
mov bl, 1
mov byte [esp + 0x1b], bl
call fcn.00406100
push 1
call fcn.00405bd0
jmp case.default.0x4045aa
mov bl, 1
mov byte [esp + 0x1b], bl
call fcn.00406100
push 1
call fcn.00405bd0
call fcn.0041fb5f
mov eax, dword [eax + 4]
push 0x457614
push str.BootTrayType
push str.Setting
mov ecx, eax
call fcn.00425e7d
jmp case.default.0x4045aa
mov bl, 1
mov byte [esp + 0x1b], bl
call fcn.00406100
push 1
call fcn.00405bd0
push 0
call fcn.004373ff
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
call fcn.00401d80
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1658], 8
call fcn.00406f50
push eax
call fcn.0043800a
add esp, 4
push 0
cdq
push 0x15180
push edx
push eax
call fcn.0043baf0
add dword [esp + 0x24], eax
adc dword [esp + 0x28], edx
call fcn.0041fb5f
mov eax, dword [eax + 4]
push 0x457614
push str.FirstRunDate
push str.Setting
mov ecx, eax
call fcn.00425e7d
lea ecx, [esp + 0x24]
call fcn.00407840
push eax
lea eax, [esp + 0x18]
push 0x457acc
push eax
call fcn.00401d60
add esp, 0xc
call fcn.0041fb5f
mov ecx, dword [esp + 0x14]
mov eax, dword [eax + 4]
push ecx
push str.FirstRunDate_year
push str.Setting
mov ecx, eax
call fcn.00425e7d
lea ecx, [esp + 0x24]
call fcn.00407810
push eax
lea edx, [esp + 0x18]
push 0x457acc
push edx
call fcn.00401d60
add esp, 0xc
call fcn.0041fb5f
mov ecx, dword [esp + 0x14]
mov eax, dword [eax + 4]
push ecx
push str.FirstRunDate_mon
push str.Setting
mov ecx, eax
call fcn.00425e7d
lea ecx, [esp + 0x24]
call fcn.004077f0
push eax
lea edx, [esp + 0x18]
push 0x457acc
push edx
call fcn.00401d60
add esp, 0xc
call fcn.0041fb5f
mov ecx, dword [esp + 0x14]
mov eax, dword [eax + 4]
push ecx
push str.FirstRunDate_day
push str.Setting
mov ecx, eax
call fcn.00425e7d
lea ecx, [esp + 0x14]
mov byte [esp + 0x1658], 7
call fcn.00401600
jmp case.default.0x4045aa
mov bl, 1
mov byte [esp + 0x1b], bl
call fcn.00406100
push 1
call fcn.00405bd0
push 0
call fcn.004373ff
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
call fcn.00401d80
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1658], 9
call fcn.00406f50
push eax
call fcn.0043800a
add esp, 4
push 0
cdq
push 0x15180
push edx
push eax
call fcn.0043baf0
add dword [esp + 0x24], eax
adc dword [esp + 0x28], edx
call fcn.0041fb5f
mov eax, dword [eax + 4]
push 0x457614
push str.FirstRunDate
push str.Setting
mov ecx, eax
call fcn.00425e7d
lea ecx, [esp + 0x24]
call fcn.00407840
push eax
lea edx, [esp + 0x18]
push 0x457acc
push edx
call fcn.00401d60
add esp, 0xc
call fcn.0041fb5f
mov ecx, dword [esp + 0x14]
mov eax, dword [eax + 4]
push ecx
push str.FirstRunDate_year
push str.Setting
mov ecx, eax
call fcn.00425e7d
lea ecx, [esp + 0x24]
call fcn.00407810
push eax
lea edx, [esp + 0x18]
push 0x457acc
push edx
call fcn.00401d60
add esp, 0xc
call fcn.0041fb5f
mov ecx, dword [esp + 0x14]
mov eax, dword [eax + 4]
push ecx
push str.FirstRunDate_mon
push str.Setting
mov ecx, eax
call fcn.00425e7d
lea ecx, [esp + 0x24]
call fcn.004077f0
push eax
lea edx, [esp + 0x18]
push 0x457acc
push edx
call fcn.00401d60
add esp, 0xc
call fcn.0041fb5f
mov ecx, dword [esp + 0x14]
mov eax, dword [eax + 4]
push ecx
push str.FirstRunDate_day
push str.Setting
mov ecx, eax
call fcn.00425e7d
call fcn.0041fb5f
mov eax, dword [eax + 4]
push 0x457614
push str.BootTrayType
push str.Setting
mov ecx, eax
call fcn.00425e7d
lea ecx, [esp + 0x14]
mov byte [esp + 0x1658], 7
call fcn.00401600
jmp case.default.0x4045aa
mov byte [esp + 0x37], 1
mov byte [esp + 0x1b], 1
jmp case.default.0x4045aa
mov byte [esp + 0x23], 0
jmp case.default.0x4045aa
push 0
mov byte [esp + 0x27], 0
call fcn.00405bd0
call fcn.00405de0
mov edx, dword [esp + 0x38]
push str.Fileham.comFileHamBrowser
push edx
push str._s_shtmlLoading2.html
lea eax, [esp + 0x4c]
push eax
jmp 0x40490b
mov ecx, dword [esp + 0x38]
push str.Fileham.comFileHamBrowser
push ecx
push str._s_shtmlLoading2.html
lea edx, [esp + 0x4c]
mov byte [esp + 0x2f], 0
push edx
call fcn.00401d60
add esp, 0x10
lea eax, [esp + 0xfc]
push eax
call fcn.0040d5c0
test bl, bl
mov byte [esp + 0x1658], 0xa
je 0x404a7c
call fcn.00418933
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40494a
push 0x80004005
call fcn.00401640
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x1658], 0xb
call fcn.00418933
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40497c
push 0x80004005
call fcn.00401640
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x48], eax
mov byte [esp + 0x1658], 0xc
call fcn.00418933
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4049ae
push 0x80004005
call fcn.00401640
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x54], eax
mov bl, 0xd
mov byte [esp + 0x1658], bl
lea esi, [esp + 0x58]
mov dword [esp + 0x24], 0
call fcn.004012e0
mov byte [esp + 0x1658], 0xe
mov ecx, dword [edi + 0xa8]
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x1c]
push str.http:__www.fileham.com_main_app_setup_count.php_mac_sjoinid_s
push eax
call fcn.00401d60
mov byte [esp + 0x1668], bl
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404a23
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x10c]
call fcn.0040e260
mov byte [esp + 0x1658], 0xc
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404a6b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 0xb
mov eax, dword [esp + 0x48]
jmp 0x404bd3
cmp byte [esp + 0x37], 0
je 0x404c17
call fcn.00418933
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404aa1
push 0x80004005
call fcn.00401640
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x1658], 0xf
call fcn.00418933
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404ad3
push 0x80004005
call fcn.00401640
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x54], eax
mov byte [esp + 0x1658], 0x10
call fcn.00418933
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404b05
push 0x80004005
call fcn.00401640
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x48], eax
mov bl, 0x11
mov byte [esp + 0x1658], bl
lea esi, [esp + 0x24]
mov dword [esp + 0x58], 0
call fcn.004012e0
mov byte [esp + 0x1658], 0x12
mov ecx, dword [edi + 0xa8]
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x1c]
push str.http:__www.fileham.com_main_app_delete_count.php_mac_sjoinid_s
push eax
call fcn.00401d60
mov byte [esp + 0x1668], bl
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404b7a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x10c]
call fcn.0040e260
call fcn.004067a0
mov byte [esp + 0x1658], 0x10
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404bc7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 0xf
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404bef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 0xa
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404c17
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0xfc]
push ecx
mov byte [esp + 0x165c], 7
call fcn.0040d7f0
mov byte [esp + 0x1658], 6
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
lock xadd dword [edx], ecx
dec ecx
cmp byte [esp + 0x1b], 0
je 0x404c94
test ecx, ecx
jg 0x404c5b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 5
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404c83
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 3
mov eax, dword [esp + 0x50]
jmp 0x405787
test ecx, ecx
jg 0x404ca2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 5
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404cca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 3
mov eax, dword [esp + 0x50]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404cef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.00418933
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404d09
push 0x80004005
call fcn.00401640
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x3c], eax
push 0x456f6e
push str.FirstRunDate
push str.Setting
lea ecx, [esp + 0x30]
push ecx
mov ecx, edi
mov byte [esp + 0x1668], 0x13
call fcn.00425f13
mov eax, dword [eax]
push 0x457614
push eax
call fcn.004369f3
add esp, 8
test eax, eax
mov eax, dword [esp + 0x24]
sete bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404d71
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x4051cf
call fcn.00418933
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404d93
push 0x80004005
call fcn.00401640
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x1658], 0x14
call fcn.00418933
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404dc5
push 0x80004005
call fcn.00401640
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x1658], 0x15
call fcn.00418933
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x404df7
push 0x80004005
call fcn.00401640
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
push 0x456f6e
push str.FirstRunDate_year
push str.Setting
lea ecx, [esp + 0x30]
push ecx
mov bl, 0x16
mov ecx, edi
mov byte [esp + 0x1668], bl
call fcn.00425f13
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x165c], 0x17
call fcn.00401ae0
mov byte [esp + 0x1658], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404e64
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x456f6e
push str.FirstRunDate_mon
push str.Setting
lea ecx, [esp + 0x30]
push ecx
mov ecx, edi
call fcn.00425f13
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x165c], 0x18
call fcn.00401ae0
mov byte [esp + 0x1658], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404eb8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x456f6e
push str.FirstRunDate_day
push str.Setting
lea ecx, [esp + 0x30]
push ecx
mov ecx, edi
call fcn.00425f13
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x165c], 0x19
call fcn.00401ae0
mov byte [esp + 0x1658], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404f0c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
call fcn.004373ff
mov edi, dword [esp + 0x34]
mov esi, 1
add esp, 4
cmp dword [edi - 4], esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
jle 0x404f3d
mov ecx, dword [edi - 0xc]
push ecx
lea ecx, [esp + 0x34]
call fcn.004016e0
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
cmp dword [eax - 4], esi
jle 0x404f53
mov edx, dword [eax - 0xc]
push edx
lea ecx, [esp + 0x18]
call fcn.004016e0
mov eax, dword [esp + 0x1c]
cmp dword [eax - 4], esi
jle 0x404f69
mov eax, dword [eax - 0xc]
push eax
lea ecx, [esp + 0x20]
call fcn.004016e0
push edi
call fcn.0043800a
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
mov esi, eax
call fcn.0043800a
mov edx, dword [esp + 0x20]
add esp, 4
push edx
mov ebx, eax
call fcn.0043800a
xor ecx, ecx
add esp, 4
cmp eax, 0x76c
setge cl
test ecx, ecx
jne 0x404fa8
push 0x80004005
call fcn.00401640
lea ecx, [ebx - 1]
cmp ecx, 0xb
jbe 0x404fba
push 0x80004005
call fcn.00401640
lea edx, [esi - 1]
cmp edx, 0x1e
jbe 0x404fcc
push 0x80004005
call fcn.00401640
add eax, 0xfffff894
xor edx, edx
mov dword [esp + 0x88], eax
mov dword [esp + 0x80], esi
lea eax, [esp + 0x74]
or esi, 0xffffffff
push eax
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], edx
mov dword [esp + 0x80], edx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x98], esi
call fcn.004382c2
mov ecx, eax
and ecx, edx
add esp, 4
cmp ecx, esi
jne 0x405020
push 0x80070057
call fcn.00401640
cmp dword [esp + 0x28], edx
jg 0x405160
jl 0x405036
cmp dword [esp + 0x24], eax
jae 0x405160
lea eax, [edi - 0x10]
mov byte [esp + 0x1658], 0x15
lea edx, [eax + 0xc]
mov ecx, esi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405059
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 0x14
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405080
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 0x13
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4050a7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 3
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4050ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 2
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4050f5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 1
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40511c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 0
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405143
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1658], esi
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jmp 0x405837
lea eax, [edi - 0x10]
mov byte [esp + 0x1658], 0x15
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405183
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 0x14
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4051aa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 0x13
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x4051cf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x456f6e
push str.BootTrayType
push str.Setting
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x6c]
call fcn.00425f13
mov eax, dword [eax]
push 0x457614
push eax
call fcn.004369f3
add esp, 8
test eax, eax
mov eax, dword [esp + 0x24]
sete bl
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405221
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x40522a
mov byte [esp + 0x22], 1
push str.FileHam_Browser_Controller
push 1
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0xb7
jne 0x405268
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
nop
cmp esi, 3
je 0x405282
push 0x1f4
add esi, 1
call ebx
call edi
cmp eax, 0xb7
je 0x405250
call fcn.00418933
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4052c0
push 0x80004005
call fcn.00401640
xor esi, esi
push esi
push str.filehambrowser_class
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, esi
je 0x405778
mov edx, dword [esp + 0x5c]
lea ecx, [esp + 0x24]
push ecx
push edx
push 0x4a
push eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], 1
mov dword [esp + 0x3c], esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x405778
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x30], eax
mov byte [esp + 0x1658], 0x1a
mov ecx, dword [esp + 0x38]
push str.Fileham.comUpdater
push ecx
lea edx, [esp + 0x38]
push str._s_sFilehamUpdater.exe
push edx
call fcn.00401d60
mov esi, dword [esp + 0x40]
add esp, 0x10
cmp byte [esp + 0x23], 0
je 0x40553c
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40553c
call fcn.00418933
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40532c
push 0x80004005
call fcn.00401640
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x1658], 0x1b
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x4c]
push str.noup
push ecx
push edx
lea eax, [esp + 0x28]
push str._s_s__s
push eax
call fcn.00401d60
add esp, 0x14
push 0x3c
lea ecx, [esp + 0x9c]
push 0
push ecx
call fcn.0043b390
add esp, 0xc
mov dword [esp + 0x98], 0x3c
mov dword [esp + 0xa0], 0
call fcn.00401000
neg al
sbb eax, eax
and eax, 0x500
add eax, 0x40
mov dword [esp + 0x9c], eax
call fcn.00401000
test al, al
mov dword [esp + 0xa4], str.runas
jne 0x4053c6
mov dword [esp + 0xa4], str.open
mov ebx, 1
mov dword [esp + 0xa8], esi
mov esi, dword [esp + 0x1c]
push ebx
lea edx, [esp + 0x78]
push edx
mov dword [esp + 0xb4], esi
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xb8], 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push ebx
lea eax, [esp + 0x80]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.FileHamBrowser.exe
push 0
push 0
lea edx, [esp + 0x74]
lea ecx, [esp + 0x80]
push edx
mov dword [esp + 0x78], 0xc
mov dword [esp + 0x80], ebx
mov dword [esp + 0x7c], ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x4054db
mov ecx, dword [esp + 0xd0]
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x2c]
push edx
push 2
mov dword [esp + 0x38], ecx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x4054c5
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x1c]
call fcn.00401600
lea ecx, [esp + 0x30]
call fcn.00401600
lea ecx, [esp + 0x3c]
call fcn.00401600
lea ecx, [esp + 0x40]
call fcn.00401600
lea ecx, [esp + 0x4c]
call fcn.00401600
lea ecx, [esp + 0x44]
call fcn.00401600
lea ecx, [esp + 0x38]
call fcn.00401600
jmp 0x405843
mov ecx, dword [esp + 0x24]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call edi
mov edx, dword [esp + 0x28]
push edx
call edi
jmp 0x405518
lea ecx, [esp + 0x14]
call fcn.00401d80
mov byte [esp + 0x1658], 0x1c
call edi
push eax
lea eax, [esp + 0x18]
push 0x4577a0
push eax
call fcn.00401d60
mov ecx, dword [esp + 0x20]
add esp, 0xc
push 0
push 0
push ecx
call fcn.004208e8
lea ecx, [esp + 0x14]
call fcn.00401600
lea eax, [esi - 0x10]
mov byte [esp + 0x1658], 0x1a
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40553c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x44c]
push ecx
call fcn.0040d5c0
mov byte [esp + 0x1658], 0x1d
call fcn.00418933
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40556b
push 0x80004005
call fcn.00401640
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x1658], 0x1e
call fcn.00418933
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40559d
push 0x80004005
call fcn.00401640
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x48], eax
mov byte [esp + 0x1658], 0x1f
call fcn.00418933
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4055cf
push 0x80004005
call fcn.00401640
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x50], eax
mov bl, 0x20
mov byte [esp + 0x1658], bl
lea esi, [esp + 0x24]
mov dword [esp + 0x58], 0
call fcn.004012e0
mov esi, dword [esp + 0x5c]
mov byte [esp + 0x1658], 0x21
mov ecx, dword [esi + 0xa8]
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x24]
push str.http:__www.fileham.com_main_app_click_count.php_mac_sjoinid_s
push eax
call fcn.00401d60
mov byte [esp + 0x1668], bl
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405648
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x5c]
push edx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x45c]
call fcn.0040e260
lea edx, [esp + 0x79c]
push edx
call fcn.00407ca0
mov cl, byte [esp + 0x22]
mov byte [esp + 0x1658], 0x22
lea edx, [esp + 0x40]
lea eax, [esp + 0x79c]
mov byte [esp + 0x10b7], cl
push edx
lea ecx, [esp + 0x10c0]
mov dword [esi + 0x20], eax
call fcn.00401ae0
lea ecx, [esp + 0x79c]
call fcn.00423475
lea eax, [esp + 0x79c]
push eax
mov byte [esp + 0x165c], bl
call fcn.004058a0
mov byte [esp + 0x1658], 0x1f
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4056eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 0x1e
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405713
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 0x1d
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40573b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x44c]
push ecx
mov byte [esp + 0x165c], 0x1a
call fcn.0040d7f0
mov byte [esp + 0x1658], 0x13
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405778
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 3
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4057a0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 2
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4057c8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 1
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4057f0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x1658], 0
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405818
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1658], 0xffffffff
mov eax, dword [esp + 0x38]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x405843
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x1650]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1638]
xor ecx, esp
call fcn.00437030
mov esp, ebp
pop ebp
ret